Which versions of Totolink A8000RU are affected by CVE-2026-9433?

Totolink A8000RU routers (firmware 7.1cu.643_b20200521 and earlier) contain an unauthenticated remote code execution vulnerability (CVSS 8.9); publicly available exploit code exists.

Is there a public PoC exploit available for CVE-2026-9433?

Yes, a public proof-of-concept exploit is available for CVE-2026-9433. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9433?

24 hours: Identify all Totolink A8000RU routers in production; immediately segment from critical networks and restrict WAN access to management interfaces. 7 days: Monitor Totolink security advisories for patch releases; implement firewall rules blocking unauthorized access to affected systems. 30 days: Execute hardware replacement with patched alternatives; document all A8000RU systems as decommissioned or validated as patched.

Totolink A8000RU CVE-2026-9433

Q: What is the CVSS score of CVE-2026-9433?

CVE-2026-9433 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31641 HIGH

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-h6vr-9r9p-c6rf

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:22 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 19:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument enable causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the 'enable' argument passed to the setMacFilterRules function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists per VulDB, and SSVC categorizes the technical impact as total with automatable exploitation, though EPSS remains modest at 0.89% (76th percentile).

Technical ContextAI

The flaw resides in the cstecgi.cgi binary that backs the Web Management Interface on Totolink A8000RU dual-band gigabit routers. The setMacFilterRules handler accepts an 'enable' parameter that is passed unsanitized into a shell context, classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Totolink consumer-grade routers historically reuse this cgi dispatcher pattern across multiple endpoints, and similar injection sinks have been disclosed across the product line. Per the CPE (cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:*), all firmware revisions sharing this build are presumed in scope until vendor confirmation narrows the range.

RemediationAI

No vendor-released patch identified at time of analysis - Totolink has not published a fixed firmware version in the referenced advisories (VulDB entries at https://vuldb.com/vuln/365414 and the NVD record https://nvd.nist.gov/vuln/detail/CVE-2026-9433). Monitor https://www.totolink.net/ for updated firmware for the A8000RU and apply it immediately when released. As compensating controls, disable remote (WAN-side) administration of the router via the web interface to eliminate internet-facing exposure (trade-off: administrators must be on the LAN or VPN to manage the device), restrict access to /cgi-bin/cstecgi.cgi from the LAN to a dedicated management VLAN or trusted IPs via upstream firewall rules where feasible, and consider replacing the device if it is end-of-life. Change default administrator credentials and disable UPnP to reduce the chance of attacker pivoting from a compromised LAN host.