CVE-2025-57457 PoC — Curo UC300 安全漏洞

Source

https://github.com/restdone/CVE-2025-57457

Associated Vulnerability

Title:Curo UC300 安全漏洞 (CVE-2025-57457)
Description:Curo UC300是英国Curo公司的一款视频电话设备。 Curo UC300 5.42.1.7.1.63R1版本存在安全漏洞，该漏洞源于IP Addr参数未经验证，可能导致OS命令注入攻击。

Readme

# OS Command Injection in CURO UC300 IP Phone
An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter.


<img width="770" height="775" alt="image" src="https://github.com/user-attachments/assets/d4392be5-6a0a-465e-afe8-8ae14c98f7ed" />

PoC: https://github.com/restdone/CVE-2025-57457/blob/main/os_commandinject.mp4
---

## Step
1. Login to the admin panel of the UC300 (IP of the phone and port 80)
2. Browse to Network, than Diagnostics
3. Inject OS Command at IP Addr field.
4. Click Start and exeucte the Linux Command on the phone.


## Timeline

3rd July 2025: 

Reported the issue to the vendor. The vendor responded on the same day.

4th July 2025: 

The vendor raised the issue internally for furthter investigation and confirmation

19th September 2025: 

The vendor confirmed the issue, conducted investigation, developed updated firmware, tested the updated firmware and rolled out to the production of the affected handset.

File Snapshot


 [4.0K]  /data/pocs/3a50ccf8743316f429123a2cf307ab1d6747dd46
├── [ 12M]  os_commandinject.mp4
└── [1.0K]  README.md

1 directory, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!