Which versions of Totolink A8000RU are affected by CVE-2026-9435?

The Totolink A8000RU router firmware version 7.1cu.643_b20200521 contains a critical remote command injection vulnerability allowing unauthenticated attackers to execute arbitrary operating system…

Is there a public PoC exploit available for CVE-2026-9435?

Yes, a public proof-of-concept exploit is available for CVE-2026-9435. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9435?

Within 24 hours: Identify all Totolink A8000RU routers running firmware 7.1cu.643_b20200521 in production; isolate affected devices from the network or power down; review network logs for HTTP/HTTPS access to /cgi-bin/cstecgi.cgi. Within 7 days: Contact Totolink support for available firmware versions; test and deploy any available security updates to non-vulnerable firmware; implement ACLs restricting router management interface access to designated administrative networks only. Within 30 days: Execute device replacement or firmware upgrade plan if patch becomes available; deploy IPS/WAF rules blocking exploitation attempts to the setQosCfg function with malformed 'enable' parameters; enforce MFA and hardened credentials on all router administrative interfaces.

Totolink A8000RU CVE-2026-9435

Q: What is the CVSS score of CVE-2026-9435?

CVE-2026-9435 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31643 HIGH

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-hjr7-w257-wr94

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:16 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 19:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setQosCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument enable results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

AnalysisAI

OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the 'enable' parameter sent to the setQosCfg function of /cgi-bin/cstecgi.cgi in the Web Management Interface. Publicly available exploit code exists per VulDB submission, and the SSVC framework rates technical impact as total with automatable exploitation, though EPSS probability remains modest at 0.89%.

Technical ContextAI

The A8000RU is a Totolink AC2600 dual-band gigabit wireless router whose web management interface is served by the cstecgi.cgi CGI binary, a common pattern across Totolink consumer firmware where HTTP form parameters are dispatched to internal handler functions. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates the setQosCfg handler passes the user-supplied 'enable' argument into a shell invocation (likely via system(), popen(), or a similar libc call) without sanitizing shell metacharacters such as ';', '|', '&', or backticks, allowing command-string breakout. The single CPE entry (cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:*) and the EUVD record both pin the issue specifically to firmware build 7.1cu.643_b20200521.

RemediationAI

No vendor-released patch identified at time of analysis - Totolink has not published a firmware update referenced in any of the available sources, so administrators should check https://www.totolink.net/ for a newer firmware release for the A8000RU and apply it as soon as one is available. Until a fix is published, the most effective compensating control is to disable WAN-side access to the web management interface entirely (most Totolink models expose this as 'Remote Management' or 'Remote Web Management' in admin settings), which eliminates internet-based exploitation at the cost of losing remote administration convenience. On the LAN side, restrict access to the router's management IP to a dedicated admin VLAN or specific MAC/IP allowlist using the router's access control list features, accepting that this complicates legitimate admin from other network segments. If the device is non-essential or end-of-life from a security perspective, the cleanest control is replacement with a currently supported router, since unpatched command injection in /cgi-bin/cstecgi.cgi is a recurring pattern across the Totolink product line. Monitoring should include logging HTTP requests to /cgi-bin/cstecgi.cgi containing shell metacharacters in the 'enable' parameter.