CVE-2025-54322: XSpeeder SXZOS Pre-Auth RCE Exploit

A professional Proof-of-Concept (PoC) exploit for CVE-2025-54322, a critical pre-authentication remote code execution vulnerability in XSpeeder SXZOS firmware. This vulnerability was discovered and disclosed by the autonomous AI agent from pwn.ai.

🔍 Vulnerability Overview

• CVE ID: CVE-2025-54322
• CVSS Score: 10.0 (Critical)
• Affected Vendor: XSpeeder
• Affected Product: SXZOS Firmware (SD-WAN / Edge Routers)
• Vulnerability Type: Unsafe eval() on user-supplied input
• Privileges Required: None (Pre-Authentication)
• Impact: Full system compromise with root privileges

✨ Features

• Interactive CMD Shell: A pseudo-shell environment with persistent directory tracking (cd support).
• One-Click Reverse Shell: Built-in multiple payloads (Bash, Python) for quick shell acquisition.
• Advanced Output Cleaning: Automatically filters out HTML tags, shell errors, and encoding artifacts from Django debug pages.
• Python 2.7 Compatibility: Specifically engineered to work with the legacy Python 2.7 environment found on target devices.
• Session Warm-up: Automatically handles the required /webInfos/ session initialization.

🚀 Getting Started

Prerequisites

• Python 3.x (Local machine)
• requests library

pip install requests

Usage

Run the exploit against a target URL:

python3 cve-2025-54322-exploit.py https://<target-ip>:<port>

Example Session

[*] Connecting to: https://1.2.3.4:4433
[*] Initializing environment...
[+] Target confirmed: root@sxzros

==================================================
  CVE-2025-54322  Exploit Tool
==================================================
  1. Enter Interactive CMD Shell
  2. One-Click Reverse Shell
  3. Exit
==================================================

FOFA

"[email protected]"

🛠️ Technical Analysis

The vulnerability stems from the unsafe use of Python's eval() function in the vLogin.py component. The server decodes a base64-encoded parameter chkid and passes it directly to eval().

Our exploit leverages the fact that many of these devices have Django's DEBUG mode enabled, allowing us to capture command output from the local variables displayed in the resulting error page.

⚠️ Disclaimer

This tool is for educational and authorized security testing purposes only. The author is not responsible for any misuse or damage caused by this tool. Unauthorized access to computer systems is illegal.