Scorpion-Security-Labs/CVE-2025-71384

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that authenticates to a target device via HTTP, constructs a buffer overflow payload using a hardcoded libc base address and ROP gadgets, and sends it to the '/api/addStaticDHCP' endpoint to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The PoC script is a straightforward buffer overflow exploit targeting a DHCP API endpoint. It builds a payload with ROP gadgets to execute a user-supplied command (default: starting a telnet daemon) and sends it via an HTTP POST. No hidden backdoor, credential exfiltration, persistence mechanism, or unrelated payload is present. The script's behavior is fully consistent with a public exploit for CVE-2025-71384.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesPython
Target softwareunknown embedded device
Attack typesbuffer overflowremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a crafted payload to a remote service to overwrite a return address and redirect execution to system(), which is the definition of an exploit.

CVE-2025-71384-PoC.py:60-64CVE-2025-71384-PoC.py:88-110

Requirements

  • Valid credentials (username/password) for the target device's web API.CVE-2025-71384-PoC.py:77-86
  • Knowledge of the target's libc base address (default 0x777ff000).CVE-2025-71384-PoC.py:131-134
  • Network access to the target's HTTP service.CVE-2025-71384-PoC.py:102-107

Observed behavior

  • Authenticates to the target by sending a POST request to /api/login with supplied credentials and extracts a session token from the Set-Cookie header.CVE-2025-71384-PoC.py:77-86
  • Constructs a payload containing a cyclic pattern, a ROP gadget address (libc+0x19eb0), padding, a shell command, and the address of system (libc+0x2c330).CVE-2025-71384-PoC.py:54-75
  • Sends the payload to /api/addStaticDHCP by replacing a placeholder string in a JSON body, triggering the buffer overflow and executing the supplied command.CVE-2025-71384-PoC.py:88-110
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Buffer overflow payload with ROP chain to execute arbitrary commandThe script constructs a payload using libc addresses and a gadget to call system() with a user-supplied command. This is standard exploit behavior for the stated CVE.CVE-2025-71384-PoC.py:54-75
Default Command
/bin/busybox telnetd -l /bin/shThe default command starts a telnet daemon, which is a common post-exploitation action for gaining remote shell access on embedded devices. This is consistent with the exploit's purpose and not a hidden backdoor.CVE-2025-71384-PoC.py:128
Network Communication
HTTP POST to /api/addStaticDHCP with exploit payloadThe script sends the crafted payload to the target's DHCP API endpoint, which is the expected attack vector for the vulnerability.CVE-2025-71384-PoC.py:88-110
Review boundaries

What the analysis did not establish

  • Only one of three repository files was provided as text; two files are omitted, so the full repository content is unknown.
  • The CVE record for CVE-2025-71384 was absent from the acquired CVEList, so no authoritative vulnerability description is available.
  • The target software and exact vulnerable endpoint are inferred from the code; no documentation or writeup is included.
  • Two additional files in the repository (total 3 files) were not included in the text evidence; their content is unknown. The analysis covers only the single provided Python script.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1