Which versions of TOTOLINK A8000RU are affected by CVE-2026-9455?

TOTOLINK A8000RU router firmware contains a high-severity unauthenticated command injection vulnerability (CVE-2026-9455) allowing remote attackers to execute arbitrary OS commands on affected…

Is there a public PoC exploit available for CVE-2026-9455?

Yes, a public proof-of-concept exploit is available for CVE-2026-9455. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9455?

WITHIN 24 HOURS: Identify and inventory all TOTOLINK A8000RU routers running firmware 7.1cu.643_b20200521 or earlier; assess network exposure of management interfaces on ports 80/443. WITHIN 7 DAYS: Implement emergency network controls-apply firewall rules blocking inbound access to management interfaces from untrusted networks, implement VLAN isolation for affected devices, restrict administrative access to authorized networks only, and monitor /cgi-bin/cstecgi.cgi for exploitation attempts. Check TOTOLINK vendor channels for any firmware updates beyond 7.1cu.643_b20200521. WITHIN 30 DAYS: Complete replacement or decommissioning of vulnerable devices; transition to alternative router platforms or apply patched firmware versions when available from vendor.

TOTOLINK A8000RU CVE-2026-9455

Q: What is the CVSS score of CVE-2026-9455?

CVE-2026-9455 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31673 HIGH

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-4crh-78xh-vwrj

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:34 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 19:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

CVE Published

May 25, 2026 - 11:45 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument FileName leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

AnalysisAI

OS command injection in TOTOLINK A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the FileName parameter in the UploadOpenVpnCert function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists per VulDB disclosure, and SSVC scoring indicates the flaw is automatable with total technical impact, though EPSS remains modest at 0.89% (76th percentile). The vulnerability is no public exploit identified in CISA KEV, but POC availability combined with network-reachable management interface elevates real-world risk.

Technical ContextAI

The TOTOLINK A8000RU is a dual-band gigabit wireless router whose web management interface is implemented through the cstecgi.cgi binary, a common CGI dispatcher across TOTOLINK firmware that routes JSON-RPC-style requests to internal handler functions. The vulnerable UploadOpenVpnCert handler processes OpenVPN certificate upload requests and uses the user-supplied FileName argument without proper sanitization or shell-metacharacter filtering before passing it to an underlying shell command (likely via system(), popen(), or similar). This is a classic CWE-78 (Improper Neutralization of Special Elements Used in an OS Command) issue, prevalent in embedded MIPS/ARM SOHO router firmware where developers concatenate user input directly into shell invocations rather than using execve-style argument arrays.

RemediationAI

No vendor-released patch identified at time of analysis - TOTOLINK has not published a fixed firmware version in the provided references. As compensating controls, administrators should immediately disable WAN-side (remote) management of the web interface to limit exposure to LAN-only attackers (trade-off: loss of remote administration capability), restrict LAN access to the /cgi-bin/cstecgi.cgi endpoint via segmented VLANs or guest-network isolation where possible, and disable the OpenVPN certificate upload functionality if it is not actively used (trade-off: cannot configure OpenVPN client/server until re-enabled). Monitor https://www.totolink.net/ and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-9455 for a patched firmware release, and consider replacing the device with an actively-supported router if no fix is forthcoming.