POC详情： 3a50ccf8743316f429123a2cf307ab1d6747dd46

来源
https://github.com/restdone/CVE-2025-57457
关联漏洞
标题： Curo UC300 安全漏洞 (CVE-2025-57457)
描述：Curo UC300是英国Curo公司的一款视频电话设备。 Curo UC300 5.42.1.7.1.63R1版本存在安全漏洞，该漏洞源于IP Addr参数未经验证，可能导致OS命令注入攻击。
介绍
# OS Command Injection in CURO UC300 IP Phone
An OS Command Injection vulnerability was discovered in CURO UC300 IP Phone (5.42.1.7.1.63R1). To successfully exploit this vulnerability, it requreies the attacker to have Administrator access to the Admin panel.

<img width="1136" height="596" alt="image" src="https://github.com/user-attachments/assets/368c0c06-cf2c-48a4-88ac-9949433857a3" />


<img width="2160" height="2426" alt="OS_ComandInjection" src="https://github.com/user-attachments/assets/dd756a0d-6850-4994-9222-b27f5c87edbc" />


---
Timeline:

3rd July: 

Reported the issue to the vendor. The vendor responded on the same day.

4th July: 

The vendor raised the issue internally for furhter investigation and confirmation

19th September: 

The vendor confirmed the issue, conducted investigation, developed updated firmware, tested the updated firmware and rolled out to the production of the affected handset.
文件快照

 [4.0K]  /data/pocs/3a50ccf8743316f429123a2cf307ab1d6747dd46
└── [ 927]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。