Which versions of Totolink A8000RU are affected by CVE-2026-9432?

Totolink A8000RU routers contain a critical vulnerability allowing unauthenticated remote attackers to execute arbitrary system commands on the device, directly compromising network perimeter…

Is there a public PoC exploit available for CVE-2026-9432?

Yes, a public proof-of-concept exploit is available for CVE-2026-9432. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9432?

Within 24 hours: Inventory all Totolink A8000RU devices and confirm firmware version (particularly 7.1cu.643_b20200521 and earlier); prioritize identifying internet-facing units and assess current exposure. Within 7 days: Implement firewall rules restricting network access to the /cgi-bin/cstecgi.cgi endpoint; deploy IDS signatures to detect exploitation attempts targeting the bgProtection parameter; enable monitoring of administrative access logs. Within 30 days: Contact Totolink to confirm patch availability and release timeline; evaluate firmware upgrade options; develop hardware replacement strategy if no patch emerges.

Totolink A8000RU CVE-2026-9432

Q: What is the CVSS score of CVE-2026-9432?

CVE-2026-9432 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31637 HIGH

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-8w2c-gjp9-mhg6

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:32 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 19:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setWiFiAdvancedCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument bgProtection results in os command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the bgProtection parameter in the setWiFiAdvancedCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists per VulDB, and SSVC classifies the issue as automatable with total technical impact, though EPSS exploitation probability remains modest at 0.89% (76th percentile).

Technical ContextAI

The affected component is the embedded web management interface (cstecgi.cgi) on the Totolink A8000RU router, a CGI binary common across Totolink consumer/SMB router firmware that exposes router configuration handlers. The setWiFiAdvancedCfg handler processes WiFi advanced configuration parameters including bgProtection, which is passed to an underlying shell/system call without proper neutralization, mapping to CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CPE cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:* indicates the firmware-level CGI application is the affected component, consistent with a broader class of Totolink CGI injection flaws.

RemediationAI

No vendor-released patch identified at time of analysis - Totolink has not published a firmware advisory in the supplied references, so administrators should monitor https://www.totolink.net/ for an updated firmware build superseding 7.1cu.643_b20200521 and apply it as soon as available. As compensating controls, disable remote/WAN access to the web management interface so /cgi-bin/cstecgi.cgi is unreachable from untrusted networks (side effect: remote administration must be performed via VPN), restrict LAN-side access to the management UI via firewall ACLs to a dedicated management host or VLAN (side effect: ad-hoc admin from arbitrary clients breaks), and change default credentials and disable UPnP to reduce adjacent attack paths. Where feasible, replace the device with a supported model, since end-of-life Totolink consumer routers frequently do not receive timely fixes for cstecgi.cgi-class flaws.