Which versions of Totolink A8000RU are affected by CVE-2026-9475?

The Totolik A8000RU router contains an unauthenticated remote code execution vulnerability (CVE-2026-9475, CVSS 8.9) allowing attackers to execute arbitrary operating system commands through the…

Is there a public PoC exploit available for CVE-2026-9475?

Yes, a public proof-of-concept exploit is available for CVE-2026-9475. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9475?

24 hours: Identify all A8000RU routers running firmware 7.1cu.643_b20200521 or earlier; implement firewall rules to restrict external access to management interfaces; enable detailed logging on affected devices. 7 days: Contact Totolik to confirm patch availability timeline; if unavailable, initiate procurement process for replacement routers from vendors with active security support. 30 days: Complete migration to alternative network infrastructure; retire all A8000RU devices from production environments.

Totolink A8000RU CVE-2026-9475

Q: What is the CVSS score of CVE-2026-9475?

CVE-2026-9475 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31708 HIGH

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-25hv-9wxj-cgm5

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:43 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 20:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument Comment causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows unauthenticated remote attackers to execute arbitrary operating system commands via the Comment parameter handled by the setIpQosRules function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists and the SSVC framework rates the technical impact as total with automatable exploitation, though no public exploit identified at time of analysis as actively exploited in the CISA KEV catalog. EPSS sits at 0.89% (76th percentile), suggesting moderate but non-trivial exploitation interest.

Technical ContextAI

The Totolink A8000RU is a consumer/SMB wireless router whose web management interface is implemented via CGI handlers in /cgi-bin/cstecgi.cgi - a common monolithic CGI binary across Totolink devices that dispatches to handler functions like setIpQosRules based on request parameters. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), where the Comment argument supplied to setIpQosRules is passed into a shell or system() call without sanitization, allowing shell metacharacters (;, |, `, $()) to break out of the intended command. The CPE cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:* indicates all A8000RU versions are potentially in scope, though EUVD specifically names firmware 7.1cu.643_b20200521.

RemediationAI

No vendor-released patch identified at time of analysis - the references include the vendor homepage (https://www.totolink.net/) and the VulDB advisory (https://vuldb.com/vuln/365456) but no fixed firmware version. Until Totolink publishes patched firmware, restrict access to the web management interface by disabling WAN-side remote administration (trade-off: loss of remote management convenience), placing the router's management VLAN/IP behind an ACL that only permits trusted internal hosts, and blocking inbound access to /cgi-bin/cstecgi.cgi at any upstream firewall (trade-off: this breaks legitimate web administration from blocked sources). Consider replacing the device if it has reached end-of-support, since SOHO routers with public OS command injection often see follow-on IoT botnet recruitment.