Sachinart/CVE-2025-54322

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A multi-threaded Python scanner that checks for CVE-2025-54322 by sending a crafted HTTP request to a target and inspecting the response for indicators of command execution. It does not establish an interactive shell or deliver a payload beyond a detection probe.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README and a Python scanner for CVE-2025-54322. The scanner sends crafted HTTP requests to test for the vulnerability and checks responses for command output. No concealed executable behavior, unrelated payload, credential theft, persistence, or operator-directed harm was observed. The code performs only the advertised vulnerability scanning.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareXSpeeder SXZOS firmware
Attack typesRemote Code Execution (RCE) detection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code's primary purpose is to detect the presence of CVE-2025-54322 by sending a probe and analyzing the response for signs of successful command execution. It does not provide an interactive shell, exfiltrate data, or perform any post-exploitation actions. The README explicitly describes it as a 'vulnerability scanner' and 'RCE Vulnerability Checker'.

README.md:1README.md:7scanner.py:115-224

Requirements

  • Target URL of a potentially vulnerable XSpeeder SXZOS devicescanner.py:226-231
  • Network connectivity to the targetscanner.py:100-110

Observed behavior

  • Sends an HTTP GET request to /?title=ABC&oIp=XXX&chkid=<base64_payload> with a calculated nonce header and spoofed User-Agentscanner.py:100-110scanner.py:71-77scanner.py:119-126
  • Inspects the HTTP response body for the output of the 'id' command (uid/gid pattern) or other code execution indicatorsscanner.py:156-196
  • Logs vulnerable targets to console and writes them to a local file (vuln-confirm.txt)scanner.py:245-256scanner.py:28-35
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Payload
__import__("os").system("id") or __import__("subprocess").check_output("id", shell=True).decode() #sUserCodexsPwdThe scanner builds a payload that executes the 'id' command on the target to confirm RCE. This matches the described CVE exploitation technique.scanner.py:75
Network Request
GET /?title=ABC&oIp=XXX&chkid=<base64_payload>The scanner sends the exploit payload to the target's root path with specific query parameters, consistent with the CVE description.scanner.py:103
Output File
vuln-confirm.txtThe scanner writes confirmed vulnerable hosts and command output to a local file for reporting.scanner.py:28-35
Review boundaries

What the analysis did not establish

  • Evidence consists of two complete text files (README.md and scanner.py) from a repository snapshot. No binary files or additional source files were present. The analysis is based solely on static review of the provided source code; the code was not executed.
  • Only the two text files (README.md and scanner.py) were provided; no other repository files (e.g., requirements.txt, LICENSE) were included, but their absence does not affect the backdoor assessment.
  • The analysis is static and does not execute the code; dynamic behavior or network interactions are not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1