Proof-of-Concept exploit for CVE-2025-7795 – A buffer overflow vulnerability affecting certain Tenda routers. The exploit sends crafted POST requests to trigger a crash and confirms the impact using ICMP (ping) checks.# CVE-2025-7795 – Tenda Router Buffer Overflow Exploit
> **Author**: Byte Reaper
> **Telegram**: [@ByteReaper0](https://t.me/ByteReaper0)
> **CVE-ID**: CVE-2025-7795
> **Vulnerability Type**: Buffer Overflow
> **Target**: Tenda Routers
> **Exploit**: Remote, Unauthenticated
---
## 📝 Description
A **buffer overflow** vulnerability exists in certain Tenda router models. It can be triggered by sending a crafted unauthenticated `POST` request to the unprotected endpoint:
Save the exploit source code to exploit.c.
Compile the code:
gcc exploit.c argparse.c -o exploit -lcurl
## Usage
sudo ./exploit -i <TARGET_IP> [-v]
# or
sudo ./exploit -u <TARGET_URL> [-v]
-i, --ip : Target device IP address.
-u, --url : Full URL to the target (e.g., http://192.168.0.1).
-v, --verbose: Enable verbose output (prints request payloads and details).
Examples
Exploit by IP:
sudo ./exploit -i 192.168.1.1
Exploit by URL with verbose mode:
sudo ./exploit -u http://router.local -v
🔍 How It Works
The exploit generates a POST payload of the form list=AAAA…, starting at 3500 bytes and increasing by 1000 bytes each iteration (5 iterations total).
It sends the request to /goform/fromP2pListFilter using libcurl.
On HTTP 2xx responses, it reports that the server is still responsive.
On non-2xx responses or connection failures, it issues a ping to the target IP to confirm whether the device has crashed.
⚠️ Disclaimer
Authorized testing only: Use this exploit solely in environments where you have explicit permission to test.
Legal notice: Unauthorized use against systems you do not own or have permission to test may be illegal.
登录后查看神龙缓存的 POC 文件快照
登录查看