Scorpion-Security-Labs Exploits and Proofs of Concept

Showing 3 PoCs on this page

GitHub

Scorpion-Security-Labs/CVE-2025-71384

Repository PoC0Created 2026-07-01ExploitCVE-2025-713843 files

41.9 KiB

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

A Python script that authenticates to a target device via HTTP, constructs a buffer overflow payload using a hardcoded libc base address and ROP gadgets, and sends it to the '/api/addStaticDHCP' endpoint to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The PoC script is a straightforward buffer overflow exploit targeting a DHCP API endpoint. It builds a payload with ROP gadgets to execute a user-supplied command (default: starting a telnet daemon) and sends it via an HTTP POST. No hidden backdoor, credential exfiltration, persistence mechanism, or unrelated payload is present. The script's behavior is fully consistent with a public exploit for CVE-2025-71384.

ClassificationExploit

Model confidence95%

AuthenticationRequired

LanguagesPython

Target softwareunknown embedded device

Attack typesbuffer overflowremote code execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a crafted payload to a remote service to overwrite a return address and redirect execution to system(), which is the definition of an exploit.

CVE-2025-71384-PoC.py:60-64CVE-2025-71384-PoC.py:88-110

Requirements

Valid credentials (username/password) for the target device's web API.CVE-2025-71384-PoC.py:77-86
Knowledge of the target's libc base address (default 0x777ff000).CVE-2025-71384-PoC.py:131-134
Network access to the target's HTTP service.CVE-2025-71384-PoC.py:102-107

Observed behavior

Authenticates to the target by sending a POST request to /api/login with supplied credentials and extracts a session token from the Set-Cookie header.CVE-2025-71384-PoC.py:77-86
Constructs a payload containing a cyclic pattern, a ROP gadget address (libc+0x19eb0), padding, a shell command, and the address of system (libc+0x2c330).CVE-2025-71384-PoC.py:54-75
Sends the payload to /api/addStaticDHCP by replacing a placeholder string in a JSON body, triggering the buffer overflow and executing the supplied command.CVE-2025-71384-PoC.py:88-110

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior: Payload withheldThe script constructs a payload using libc addresses and a gadget to call system() with a user-supplied command. This is standard exploit behavior for the stated CVE.CVE-2025-71384-PoC.py:54-75
Default Command: Payload withheldThe default command starts a telnet daemon, which is a common post-exploitation action for gaining remote shell access on embedded devices. This is consistent with the exploit's purpose and not a hidden backdoor.CVE-2025-71384-PoC.py:128
Network Communication: Payload withheldThe script sends the crafted payload to the target's DHCP API endpoint, which is the expected attack vector for the vulnerability.CVE-2025-71384-PoC.py:88-110

Review boundaries

What the analysis did not establish

Only one of three repository files was provided as text; two files are omitted, so the full repository content is unknown.
The CVE record for CVE-2025-71384 was absent from the acquired CVEList, so no authoritative vulnerability description is available.
The target software and exact vulnerable endpoint are inferred from the code; no documentation or writeup is included.
Two additional files in the repository (total 3 files) were not included in the text evidence; their content is unknown. The analysis covers only the single provided Python script.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub