Which versions of Totolink A8000RU are affected by CVE-2026-9476?

The Totolik A8000RU router, a common enterprise network appliance, contains an unauthenticated remote command execution flaw affecting firmware 7.1cu.643_b20200521 and earlier.

Is there a public PoC exploit available for CVE-2026-9476?

Yes, a public proof-of-concept exploit is available for CVE-2026-9476. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9476?

24 hours: Conduct comprehensive inventory to identify all Totolik A8000RU devices in use; document firmware versions and network accessibility. 7 days: Implement firewall rules blocking external access to router CGI endpoints; disable remote administrative management and enforce local-only access. 30 days: Establish device replacement procurement plan; contact Totolik for patch timeline; document all affected devices in enterprise risk register with mitigation status.

Totolink A8000RU CVE-2026-9476

Q: What is the CVSS score of CVE-2026-9476?

CVE-2026-9476 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31709 HIGH

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-5hgh-g649-8hm2

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:17 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 20:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument admpass leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used.

AnalysisAI

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the admpass parameter sent to the setPasswordCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists and the flaw is reachable over the network without user interaction, though no public exploit identified at time of analysis indicates active in-the-wild abuse via CISA KEV.

Technical ContextAI

The Totolink A8000RU is a consumer/SOHO wireless router whose web management interface is served by the cstecgi.cgi binary, a common CGI handler used across many Totolink firmware lines. The vulnerable setPasswordCfg handler takes the admpass parameter and passes it into an OS command without proper neutralization of shell metacharacters - the root cause class identified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). This pattern of unsanitized CGI parameters being concatenated into system()/popen()-style shell invocations is well-documented across the Totolink product family and is why command injection bugs are recurring findings for this vendor.

RemediationAI

No vendor-released patch identified at time of analysis - the provided references include VulDB entries and a PoC but no Totolink firmware advisory or fixed version. Owners should monitor https://www.totolink.net/ for an updated firmware release and apply it as soon as it is published. As compensating controls, disable remote/WAN administration on the device so /cgi-bin/cstecgi.cgi is not reachable from the internet (trade-off: loses remote management convenience), restrict access to the LAN-side web management interface via an ACL or management VLAN limited to trusted administrative hosts (trade-off: administrators must operate from the management network), and block inbound HTTP/HTTPS to the router's management port at the upstream firewall (trade-off: any legitimate remote management tooling will need a VPN). Where the device is internet-exposed and no firmware fix is available, replacing the unit with a supported router is the most defensible option.