Which versions of Totolink A8000RU are affected by CVE-2026-9436?

Totolink A8000RU routers running firmware 7.1cu.643_b20200521 are vulnerable to unauthenticated remote code execution (CVSS 8.9) via OS command injection in the L2TP server configuration interface.

Is there a public PoC exploit available for CVE-2026-9436?

Yes, a public proof-of-concept exploit is available for CVE-2026-9436. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9436?

Within 24 hours: inventory all Totolink A8000RU routers and identify those running firmware 7.1cu.643_b20200521. Within 7 days: isolate affected routers from untrusted network segments and restrict administrative access to whitelisted IPs; escalate to Totolink support for patch timeline and availability. Within 30 days: deploy patched firmware when released by vendor, or proceed with replacement if vendor patch timeline exceeds 30 days.

Totolink A8000RU CVE-2026-9436

Q: What is the CVSS score of CVE-2026-9436?

CVE-2026-9436 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31644 HIGH

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-66fw-g229-xchr

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:40 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 19:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used.

AnalysisAI

OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the 'enable' argument passed to the setL2tpServerCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (published on GitHub), though EPSS probability remains modest at 0.94% (76th percentile), and the issue is not currently listed in CISA KEV.

Technical ContextAI

The vulnerability resides in the Web Management Interface CGI handler (/cgi-bin/cstecgi.cgi) of the Totolink A8000RU, a SOHO-class router. The setL2tpServerCfg function, responsible for configuring the L2TP VPN server feature, fails to sanitize the 'enable' parameter before incorporating it into a shell command, matching the CWE-78 (Improper Neutralization of Special Elements used in an OS Command) pattern that is endemic to MIPS/ARM consumer router firmware where configuration values are commonly passed to system()/popen() calls. The affected CPE is cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:*, indicating the issue is tied to the firmware build 7.1cu.643_b20200521 rather than a specific hardware revision.

RemediationAI

No vendor-released patch identified at time of analysis - Totolink has not published a fixed firmware version in the available references, and the vendor advisory page (https://www.totolink.net/) should be monitored for an updated build superseding 7.1cu.643_b20200521. As compensating controls, administrators should immediately disable WAN-side access to the Web Management Interface (the entry point /cgi-bin/cstecgi.cgi) so the CGI endpoint is unreachable from untrusted networks, restrict LAN-side management to a dedicated admin VLAN or specific source IPs, and disable the L2TP server feature if not in use to remove the code path through setL2tpServerCfg; the trade-off is loss of remote administration convenience and any in-use L2TP VPN functionality. Where feasible, place the router behind an upstream firewall that drops inbound HTTP/HTTPS to the device, and consider replacing end-of-life Totolink hardware that no longer receives vendor security updates. Additional context is available at https://vuldb.com/vuln/365417.