frozenka/cve-2025-26318POC CVE-2025-26318
TSplus is, by default, vulnerable to the disclosure of information from users currently connected to the domain on TSplus.
This vulnerability allows attackers to retrieve a list of all domain accounts currently connected to the application.
This can have serious consequences, providing a wealth of exploitable information for highly targeted phishing or vishing attacks.
This repository contains a script that exploits the TSplus vulnerability.
It retrieves connected users at regular intervals and logs them uniquely into a file to maximize the number of valid users captured from the domain.
📂 PoC File: exploit.py
Attackers can exploit this flaw to:
Following responsible disclosure, the TSplus development team addressed this vulnerability.📌 As of October 30, 2024, the vendor has implemented the following fix:
The /cgi-bin/hb.exe endpoint no longer lists usernames.
A new dedicated API endpoint was introduced: /api/loadbalancing/load on port 19955.
This new endpoint requires signed messages with a timestamp for authentication.
Vendor Confirmation (October 30, 2024):
"We have removed the user listing from the endpoint /cgi-bin/hb.exe. A new dedicated endpoint /api/loadbalancing/load on port 19955 has been implemented, which requires signed messages with a timestamp. The fix is available in the beta version of Remote Access."
This PoC is intended for educational and research purposes only.
Do not exploit systems without explicit permission.
💡 If you find this useful, consider starring the repo! ⭐
