Which versions of Totolink A8000RU are affected by CVE-2026-9387?

The Totolik A8000RU router contains a critical remote command injection vulnerability (CVE-2026-9387) enabling unauthenticated attackers to execute arbitrary system commands through the web…

Is there a public PoC exploit available for CVE-2026-9387?

Yes, a public proof-of-concept exploit is available for CVE-2026-9387. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9387?

24 hours: Identify and inventory all Totolik A8000RU devices running firmware 7.1cu.643_b20200521 or earlier; assess network exposure and document dependencies. 7 days: Implement firewall rules restricting web interface access (ports 80/443) to trusted administrative sources; deploy IDS/IPS signatures for CVE-2026-9387; establish monitoring for exploitation indicators; contact Totolik support regarding patch availability. 30 days: Execute hardware replacement plan or deploy vendor patch when released; conduct network forensics to identify any prior compromises; review and enhance network segmentation strategy.

Totolink A8000RU CVE-2026-9387

Q: What is the CVSS score of CVE-2026-9387?

CVE-2026-9387 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31543 HIGH

OS Command Injection (CWE-78)

2026-05-24 VulDB

GHSA-q68g-wg9j-v69v

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:26 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 19:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument resetFlags results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands via the resetFlags parameter handled by the setUpgradeFW function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and the SSVC framework classifies exploitation as automatable with total technical impact, though EPSS remains modest at 0.89% (76th percentile).

Technical ContextAI

The vulnerability resides in the Web Management Interface of the Totolink A8000RU, a SOHO/business-class router. The flawed endpoint is the CGI handler /cgi-bin/cstecgi.cgi, which dispatches to internal functions including setUpgradeFW. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) applies because the resetFlags argument is passed into a shell-executing context (likely via system(), popen(), or equivalent) without sanitization of metacharacters such as ;, &&, |, or backticks. The affected CPE is cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:*, and Totolink's cstecgi.cgi binary has a long history of similar command-injection sinks across the firmware family, indicating a recurring pattern of unsafe shell construction in their web management stack.

RemediationAI

No vendor-released patch identified at time of analysis - Totolink has not published an advisory or fixed firmware for CVE-2026-9387 according to the provided references. Until a fixed firmware is released, restrict access to the Web Management Interface by disabling WAN-side administration (a standard router setting that prevents Internet-facing exposure of /cgi-bin/cstecgi.cgi but does not protect against LAN-side attackers or compromised internal hosts), and place the device behind a firewall ACL that limits management access to a dedicated admin VLAN or specific source IPs. Where feasible, replace the device with a supported model, since Totolink's repeated cstecgi.cgi command-injection issues suggest systemic insecure CGI handling. Monitor the Totolink site (https://www.totolink.net/) and the VulDB entry (https://vuldb.com/vuln/365350) for a firmware update, and watch network logs for unexpected POST requests to /cgi-bin/cstecgi.cgi containing shell metacharacters in the resetFlags parameter.