Which versions of Totolink A8000RU are affected by CVE-2026-9434?

Critical vulnerability in Totolik A8000RU routers enables unauthenticated remote code execution on network infrastructure, creating direct risk of network compromise and lateral movement into…

Is there a public PoC exploit available for CVE-2026-9434?

Yes, a public proof-of-concept exploit is available for CVE-2026-9434. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9434?

Within 24 hours: Identify all Totolik A8000RU routers in production (particularly firmware 7.1cu.643_b20200521) and isolate from direct internet access if possible. Within 7 days: Implement firewall rules restricting management interface access, disable WPS functionality if operationally unnecessary, and enable comprehensive audit logging. Within 30 days: Contact Totolik for patch timeline; if unavailable, execute replacement strategy with alternative vendors or deploy additional network-based protections (IDS/IPS signatures, network segmentation).

Totolink A8000RU CVE-2026-9434

Q: What is the CVSS score of CVE-2026-9434?

CVE-2026-9434 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31640 HIGH

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-vcjq-89x6-qhff

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:19 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 19:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setWiFiWpsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument wscDisabled leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows unauthenticated remote attackers to execute arbitrary operating system commands by manipulating the wscDisabled parameter sent to the setWiFiWpsCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists per VulDB disclosure, though EPSS probability remains modest at 0.89% (76th percentile) and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The affected component is the Web Management Interface of the Totolink A8000RU SOHO/SMB router, specifically the CGI handler at /cgi-bin/cstecgi.cgi which dispatches configuration requests to internal functions such as setWiFiWpsCfg. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates the wscDisabled argument controlling WPS configuration is passed into a shell or system() call without sanitization, allowing shell metacharacters to break out of the intended command context. The CPE cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:* confirms the router product line is the sole affected scope, and similar cstecgi.cgi command injection patterns have been recurrently disclosed across the Totolink product family by VulDB researchers.

RemediationAI

No vendor-released patch identified at time of analysis - Totolink has not published a fixed firmware version in the referenced advisories. Until a firmware update is released at https://www.totolink.net/, operators should immediately restrict access to the web management interface by disabling remote/WAN administration entirely (trading off the ability to manage the router from outside the LAN), placing the management VLAN behind an ACL that allows only specific trusted admin IPs (which complicates legitimate admin workflows), and disabling WPS functionality where possible to reduce reachability of the setWiFiWpsCfg handler (with the side effect that WPS-based client onboarding will no longer work). Monitor https://nvd.nist.gov/vuln/detail/CVE-2026-9434 and the vendor site for a firmware release addressing CVE-2026-9434, and consider replacement of end-of-support hardware if no fix is forthcoming.