Which versions of TOTOLINK A8000RU are affected by CVE-2026-9408?

TOTOLINK A8000RU routers (firmware 7.1cu.643_b20200521) suffer from remote code execution vulnerabilities exploitable without authentication, enabling attackers to seize full control of affected…

Is there a public PoC exploit available for CVE-2026-9408?

Yes, a public proof-of-concept exploit is available for CVE-2026-9408. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9408?

Within 24 hours: Identify all TOTOLINK A8000RU routers in your environment, document firmware versions, and audit which devices have internet-accessible management interfaces. Within 7 days: Implement emergency network segmentation (move management interfaces to isolated VLANs, restrict access via firewall rules, or disable internet-facing management entirely) and escalate procurement of replacement router models. Within 30 days: Complete replacement of all affected TOTOLINK A8000RU units with supported alternatives; do not rely solely on network controls long-term.

TOTOLINK A8000RU CVE-2026-9408

Q: What is the CVSS score of CVE-2026-9408?

CVE-2026-9408 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31609 HIGH

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-rq43-h4ch-33gm

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:40 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 19:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument enable results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.

AnalysisAI

OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the 'enable' parameter passed to the setStaticDhcpRules function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists and SSVC rates this as automatable with total technical impact, though EPSS remains modest at 0.89% (76th percentile). Exploitation requires no authentication or user interaction, making any internet-exposed management interface a high-priority target.

Technical ContextAI

The TOTOLINK A8000RU is a consumer/SOHO wireless router whose web management interface is implemented as CGI handlers under /cgi-bin/cstecgi.cgi, a common shared binary across TOTOLINK firmware that dispatches to function handlers based on the request payload. The setStaticDhcpRules handler accepts an 'enable' argument that is passed into a shell context without proper sanitization, matching CWE-78 (Improper Neutralization of Special Elements used in an OS Command - 'OS Command Injection'). Because cstecgi.cgi typically runs with root privileges on TOTOLINK devices, successful injection yields full device control, including access to LAN traffic, credentials, and the ability to pivot into the internal network. The affected CPE is cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:* with the specific build identified as 7.1cu.643_b20200521.

RemediationAI

No vendor-released patch identified at time of analysis - neither TOTOLINK nor the VulDB/EUVD references cite a fixed firmware version, so defenders should treat this as unpatched and apply compensating controls. Disable remote/WAN-side access to the web management interface and restrict LAN-side access to a trusted administrative VLAN or specific management IPs, accepting the trade-off that legitimate remote administration via the device's web UI will be blocked. Block inbound traffic to the device's HTTP/HTTPS management ports at any upstream firewall, monitor for POST requests to /cgi-bin/cstecgi.cgi referencing setStaticDhcpRules with shell metacharacters in the 'enable' parameter, and consider replacing the device if it is end-of-life or no longer receiving updates. Track the vendor page (https://www.totolink.net/) and the VulDB advisory (https://vuldb.com/vuln/365389) for a future firmware release and apply it as soon as it is published.