Which versions of Totolink A8000RU are affected by CVE-2026-9404?

Totolik A8000RU routers (firmware 7.1cu.643_b20200521) contain a critical unauthenticated remote code execution vulnerability with publicly available exploit code.

Is there a public PoC exploit available for CVE-2026-9404?

Yes, a public proof-of-concept exploit is available for CVE-2026-9404. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9404?

Within 24 hours: Inventory all Totolik A8000RU devices running firmware 7.1cu.643_b20200521 or earlier; isolate affected units from production networks where possible. Within 7 days: Contact Totolik support for patched firmware availability or end-of-life clarification; initiate hardware replacement procurement with alternative gateway vendors. Within 30 days: Execute hardware replacement or document approved network segmentation controls; decommission affected devices from production environments.

Totolink A8000RU CVE-2026-9404

Q: What is the CVSS score of CVE-2026-9404?

CVE-2026-9404 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31607 HIGH

OS Command Injection (CWE-78)

2026-05-24 VulDB

GHSA-7vm6-8rjp-xqmw

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:27 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 19:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument provider leads to os command injection. The attack may be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary shell commands by manipulating the 'provider' argument passed to the setDdnsCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (CVSS 4.0 base 8.9, EPSS 0.89%), and no CISA KEV listing has been issued, but the combination of zero-privilege network exploitation and a working PoC against consumer/SOHO networking gear makes this a high-priority issue for any exposed device.

Technical ContextAI

The vulnerability resides in the Web Management Interface CGI handler cstecgi.cgi, specifically the setDdnsCfg function that processes Dynamic DNS configuration submissions. The 'provider' parameter - typically used to select a DDNS service provider name - is concatenated into a shell command without proper sanitization or argument quoting, the classic root cause described by CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Because Totolink's CGI binaries run as root on the embedded Linux firmware (cpe:2.3:a:totolink:a8000ru:*), any injected shell metacharacters execute with full system privileges. The A8000RU is an AC1200 dual-band gigabit router commonly deployed in small office/home environments.

RemediationAI

No vendor-released patch identified at time of analysis - Totolink has not published a fixed firmware build in the supplied references. Until a fixed image is available, restrict access to the Web Management Interface by disabling remote (WAN-side) administration entirely in the router settings and limiting LAN-side admin access to a dedicated management host or VLAN, which prevents the unauthenticated attacker from reaching /cgi-bin/cstecgi.cgi; the trade-off is loss of convenient remote management. Additionally, disable the Dynamic DNS feature so the vulnerable setDdnsCfg handler is not exercised in normal operation (trade-off: hostnames will no longer auto-update with the WAN IP). Monitor for new firmware at https://www.totolink.net/ and track the VulDB record at https://vuldb.com/vuln/365385; consider replacing end-of-support hardware if no patch is released. The public PoC at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_336/README.md can be used by defenders to validate that mitigations block the attack.