nkuty/cve-2025-54322-exploitProof-of-concept exploit for CVE-2025-54322, a critical pre-authentication RCE in XSpeeder SXZOS firmware. Provides interactive shell, reverse shell payloads, and automated session initialization for authorized security testing.
A professional Proof-of-Concept (PoC) exploit for CVE-2025-54322, a critical pre-authentication remote code execution vulnerability in XSpeeder SXZOS firmware. This vulnerability was discovered and disclosed by the autonomous AI agent from pwn.ai.
eval() on user-supplied inputcd support)./webInfos/ session initialization.requests librarypip install requests
Run the exploit against a target URL:
python3 cve-2025-54322-exploit.py https://<target-ip>:<port>
[*] Connecting to: https://1.2.3.4:4433
[*] Initializing environment...
[+] Target confirmed: root@sxzros
==================================================
CVE-2025-54322 Exploit Tool
==================================================
1. Enter Interactive CMD Shell
2. One-Click Reverse Shell
3. Exit
==================================================
The vulnerability stems from the unsafe use of Python's eval() function in the vLogin.py component. The server decodes a base64-encoded parameter chkid and passes it directly to eval().
Our exploit leverages the fact that many of these devices have Django's DEBUG mode enabled, allowing us to capture command output from the local variables displayed in the resulting error page.
This tool is for educational and authorized security testing purposes only. The author is not responsible for any misuse or damage caused by this tool. Unauthorized access to computer systems is illegal.