CVE-2025-13943

Classification basis

The rce.py script performs all steps required to exploit the vulnerability: it authenticates, injects a malicious command into a packet capture, and triggers the vulnerable log export function to execute the command, resulting in a reverse shell. This is active exploitation, not just detection.

Requirements

• Valid credentials for the target device's web interface.rce.py:7-8
• Target device must be running a vulnerable Zyxel firmware version with the zhttpd binary.README.md:3
• Attacker must provide target IP/hostname and attacker IP as command-line arguments.rce.py:10-12

Observed behavior

• Starts a netcat listener on the attacker machine to receive the reverse shell.rce.py:72-74
• Authenticates to the target device using the provided credentials and obtains a session key.rce.py:86-102
• Sends authenticated requests to start a packet capture on the target device.rce.py:108-110
• Sends an HTTP request with a malicious header containing a reverse shell command to be captured by tcpdump.rce.py:112-113
• Stops the packet capture and triggers the log export function, which causes the injected command to be executed via a system() call.rce.py:115-120

Observables

Reverse Shell

Payload withheldThe script constructs a reverse shell command using the attacker-supplied IP and port, which is injected into the vulnerable endpoint to gain remote access. This is the intended exploit payload.rce.py:15

Command Injection

Payload withheldThe script injects the reverse shell command into an HTTP header, which is later executed by the vulnerable system() call in the target firmware. This matches the described vulnerability.rce.py:113

Listener

Payload withheldThe script starts a netcat listener on the attacker machine to receive the reverse shell connection. This is standard exploit behavior.rce.py:16rce.py:73-74