CVE-2025-57457 PoC — Curo UC300 安全漏洞

Source

https://github.com/restdone/CVE-2025-57457

Associated Vulnerability

Title:Curo UC300 安全漏洞 (CVE-2025-57457)
Description:An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter.

Readme

# OS Command Injection in CURO UC300 IP Phone
An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter.


<img width="770" height="775" alt="image" src="https://github.com/user-attachments/assets/d4392be5-6a0a-465e-afe8-8ae14c98f7ed" />

PoC: https://github.com/restdone/CVE-2025-57457/blob/main/os_commandinject.mp4
---

## Step
1. Login to the admin panel of the UC300 (IP of the phone and port 80)
2. Browse to Network, than Diagnostics
3. Inject OS Command at IP Addr field.
4. Click Start and exeucte the Linux Command on the phone.


## Timeline

3rd July 2025: 

Reported the issue to the vendor. The vendor responded on the same day.

4th July 2025: 

The vendor raised the issue internally for furthter investigation and confirmation

19th September 2025: 

The vendor confirmed the issue, conducted investigation, developed updated firmware, tested the updated firmware and rolled out to the production of the affected handset.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →