Which versions of Totolink A8000RU are affected by CVE-2026-9384?

The Totolik A8000RU router running firmware 7.1cu.643_b20200521 contains a critical remote command execution vulnerability accessible without authentication, enabling attackers to completely…

Is there a public PoC exploit available for CVE-2026-9384?

Yes, a public proof-of-concept exploit is available for CVE-2026-9384. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9384?

24 hours: Scan your network for all Totolik A8000RU devices and identify those running firmware 7.1cu.643_b20200521 or earlier; restrict external management access via firewall rules. 7 days: Segment affected routers into isolated network zones separate from critical infrastructure; enable centralized logging and monitoring on these devices. 30 days: Execute replacement or decommissioning plan for all vulnerable A8000RU units; evaluate alternative router platforms with active vendor patching support.

Totolink A8000RU CVE-2026-9384

Q: What is the CVSS score of CVE-2026-9384?

CVE-2026-9384 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31594 HIGH

OS Command Injection (CWE-78)

2026-05-24 VulDB

GHSA-354q-fgjq-f9fc

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:25 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 19:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument ip results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used.

AnalysisAI

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands via the ip parameter handled by the setDiagnosisCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and the CVSS 4.0 score of 8.9 reflects high impact across confidentiality, integrity, and availability. EPSS is moderate at 0.89% (76th percentile), and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The Totolink A8000RU is a consumer/SMB wireless router whose web management interface is implemented as CGI binaries served via /cgi-bin/cstecgi.cgi. The setDiagnosisCfg handler is part of the network diagnostics functionality and accepts an 'ip' argument intended for ping/traceroute-style operations, but the value is passed to an underlying shell/system invocation without sufficient sanitization. This is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw, where shell metacharacters injected into the ip field are interpreted by the OS shell, granting code execution in the context of the web server process - typically root on embedded Linux router firmware. The single affected CPE (cpe:2.3:a:totolink:a8000ru:*) confirms the issue is scoped to this specific router model and firmware build.

RemediationAI

No vendor-released patch identified at time of analysis - the references include only the vendor homepage (https://www.totolink.net/) and VulDB/EUVD/NVD entries, with no firmware update advisory. Until Totolink publishes a fixed firmware build, operators should restrict access to the web management interface to trusted LAN segments only, explicitly disable any 'Remote Management' or WAN-side admin feature on the A8000RU (trade-off: loss of remote configuration capability), and block inbound traffic to the router's HTTP/HTTPS admin ports at any upstream firewall. Where feasible, block or filter requests to /cgi-bin/cstecgi.cgi from untrusted networks via an intermediate proxy or firewall rule (trade-off: may break legitimate management workflows that traverse that path). Monitor the vendor site and VulDB entry https://vuldb.com/vuln/365347 for a patched firmware release, and consider replacing the device with a supported model if no fix is forthcoming.