Which versions of Totolink A8000RU are affected by CVE-2026-9407?

The Totolink A8000RU router (firmware 7.1cu.643_b20200521) contains a high-severity unauthenticated remote code injection vulnerability in its firewall configuration interface that allows attackers…

Is there a public PoC exploit available for CVE-2026-9407?

Yes, a public proof-of-concept exploit is available for CVE-2026-9407. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9407?

Within 24 hours: Inventory all Totolik A8000RU routers running firmware 7.1cu.643_b20200521 or earlier versions; document network location and access controls. Within 7 days: Implement network segmentation to restrict access to the /cgi-bin/cstecgi.cgi endpoint and management interface to authorized administrative networks only; deploy network-based detection rules for exploitation attempts (monitor for firewallType parameter manipulation). Within 30 days: Contact Totolik support to confirm patch availability and release timeline; evaluate alternative router models; establish a hardware replacement or firmware upgrade plan when vendor patch is released.

Totolink A8000RU CVE-2026-9407

Q: What is the CVSS score of CVE-2026-9407?

CVE-2026-9407 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31610 HIGH

OS Command Injection (CWE-78)

2026-05-24 VulDB

GHSA-372j-76g5-g2rh

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:29 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 19:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setFirewallType of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument firewallType leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the firewallType parameter sent to /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and the SSVC framework rates the technical impact as total with automatable exploitation, though it is not currently listed in CISA KEV. EPSS sits at 0.89% (76th percentile), suggesting moderate but not yet widespread opportunistic exploitation.

Technical ContextAI

The affected component is the Web Management Interface of the Totolink A8000RU SOHO router, specifically the setFirewallType handler within the cstecgi.cgi binary - a common CGI dispatcher used across Totolink firmware that routes web administration requests to internal C functions. The root cause is CWE-78 (OS Command Injection): user-controlled input from the firewallType argument is incorporated into a shell command (likely via system(), popen(), or equivalent) without sanitization or argument validation, a recurring pattern in Totolink CGI handlers. The CPE cpe:2.3:a:totolink:a8000ru identifies the A8000RU product line as the affected target.

RemediationAI

No vendor-released patch identified at time of analysis - Totolink has not published a security advisory or firmware update for this issue in the provided references. Compensating controls should include immediately disabling WAN-side access to the Web Management Interface (the /cgi-bin/cstecgi.cgi endpoint) and restricting LAN-side admin access to a trusted management VLAN or specific source IPs, since the vulnerability is reachable through that interface; this trades off remote administration convenience for safety. Network operators should also block inbound HTTP/HTTPS to router management ports at the upstream firewall and monitor /cgi-bin/cstecgi.cgi requests containing suspicious firewallType values (shell metacharacters such as ;, |, $(, backticks). For high-risk deployments, consider replacing the A8000RU with a supported router until Totolink issues a fix; monitor https://www.totolink.net/ and https://vuldb.com/vuln/365388 for patch announcements.