Which versions of Totolink A8000RU are affected by CVE-2026-9458?

The Totolik A8000RU router contains a remote command injection vulnerability (CVE-2026-9458, CVSS 8.9) that allows unauthenticated attackers to execute arbitrary operating system commands and achieve…

Is there a public PoC exploit available for CVE-2026-9458?

Yes, a public proof-of-concept exploit is available for CVE-2026-9458. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9458?

Within 24 hours: Conduct comprehensive inventory of all Totolik A8000RU routers and identify devices running firmware 7.1cu.643_b20200521 or earlier; segregate internet-facing instances. Within 7 days: Implement network isolation (VLANs, firewall restrictions) for exposed devices; monitor Totolink security advisories for firmware updates. Within 30 days: Apply any released firmware patch immediately upon availability; if no patch is released, initiate hardware replacement or permanent disconnection of vulnerable devices.

Totolink A8000RU CVE-2026-9458

Q: What is the CVSS score of CVE-2026-9458?

CVE-2026-9458 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31678 HIGH

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-hff2-jrpw-c7ch

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:20 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 19:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument enabled leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.

AnalysisAI

Remote OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows unauthenticated attackers to execute arbitrary operating system commands through the setWanCfg function in /cgi-bin/cstecgi.cgi by manipulating the 'enabled' parameter. Publicly available exploit code exists, and with CVSS 4.0 score of 8.9 (network-reachable, low complexity, no privileges required), exposed devices face high risk despite an EPSS score of 0.89% (76th percentile) indicating moderate near-term exploitation probability.

Technical ContextAI

The vulnerability resides in the cstecgi.cgi binary, the central CGI handler used by Totolink's Web Management Interface to process configuration requests. Specifically, the setWanCfg endpoint processes WAN configuration parameters and passes the 'enabled' argument into a shell command without proper sanitization - a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw. The CPE cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:* indicates the A8000RU SOHO router platform, a consumer/SMB-grade device that typically lacks the layered defenses (SELinux, container isolation, hardened libc) found on enterprise gear, meaning successful injection generally yields shell execution at the privilege of the web daemon - frequently root on embedded Linux firmware.

RemediationAI

No vendor-released patch identified at time of analysis - Totolink has not published a firmware update or security bulletin referenced in the available data. As compensating controls, immediately disable remote (WAN-side) access to the Web Management Interface so /cgi-bin/cstecgi.cgi is only reachable from the trusted LAN; this is the highest-impact mitigation and only sacrifices the convenience of off-LAN administration. Restrict LAN-side access to the management interface to a specific admin VLAN or IP allowlist where the router firmware supports it, and place the device behind an upstream firewall that blocks inbound TCP/80 and TCP/443 to the router's WAN IP. Monitor for unusual outbound connections from the router itself as an indicator of post-exploitation activity, and consult VulDB (https://vuldb.com/vuln/365439) periodically for vendor patch updates.