Which versions of Totolink A8000RU are affected by CVE-2026-9405?

The Totolik A8000RU router (firmware 7.1cu.643_b20200521) contains an unauthenticated remote command execution vulnerability that allows attackers to gain complete control of the device without…

Is there a public PoC exploit available for CVE-2026-9405?

Yes, a public proof-of-concept exploit is available for CVE-2026-9405. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9405?

24 hours: Identify all Totolik A8000RU devices in inventory and map network exposure. 7 days: Implement firewall rules restricting management access (TCP 80/443) to trusted IP ranges only; disable remote management if not required. 30 days: Monitor vendor Totolik security advisories for firmware updates beyond version 7.1cu.643_b20200521; evaluate replacement with alternative router models from vendors with active security support if no patch is released.

Totolink A8000RU CVE-2026-9405

Q: What is the CVSS score of CVE-2026-9405?

CVE-2026-9405 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31608 HIGH

OS Command Injection (CWE-78)

2026-05-24 VulDB

GHSA-gm67-x7fw-5m4h

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:19 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 19:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setGameSpeedCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument enable results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the 'enable' parameter passed to the setGameSpeedCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, raising the practical threat despite a modest EPSS score of 0.89% (76th percentile). No active exploitation has been confirmed via CISA KEV at time of analysis.

Technical ContextAI

The flaw resides in the Web Management Interface CGI handler (cstecgi.cgi), a binary commonly used across Totolink consumer/SOHO routers to dispatch configuration RPCs. The setGameSpeedCfg handler consumes the 'enable' argument without proper sanitization or escaping before it is incorporated into a shell command, producing a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) condition. Per the CPE (cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:*), the issue affects the A8000RU product line; the EUVD record specifically names firmware A8000RU 7.1cu.643_b20200521. Successful injection runs in the context of the CGI process, which on Totolink devices is typically root, giving full device control.

RemediationAI

No vendor-released patch identified at time of analysis - Totolink has not published a fixed firmware version in the references provided (https://www.totolink.net/, https://vuldb.com/vuln/365386, https://nvd.nist.gov/vuln/detail/CVE-2026-9405). Until a firmware update is released, restrict access to the Web Management Interface by disabling remote/WAN administration entirely (trade-off: loss of remote configuration capability), placing the device's management interface on an isolated VLAN reachable only from trusted admin hosts, and blocking inbound access to the device's HTTP/HTTPS admin ports at any upstream firewall. Where feasible, replace the device or constrain it to non-sensitive segments, since cstecgi.cgi-class flaws are recurrent across Totolink models and additional un-patched parameters likely exist. Monitor the vendor site and VulDB entry 365386 for firmware updates and apply the fixed image as soon as it is published.