Which versions of Totolink A8000RU are affected by CVE-2026-9477?

Totolik A8000RU routers with firmware 7.1cu.643 contain a critical vulnerability allowing attackers to execute system commands and assume complete control of affected devices; publicly available…

Is there a public PoC exploit available for CVE-2026-9477?

Yes, a public proof-of-concept exploit is available for CVE-2026-9477. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-9477?

24 hours: Conduct an inventory of all Totolik A8000RU devices and confirm firmware versions; restrict external access to potentially affected units. 7 days: Implement network segmentation isolating affected routers; configure enhanced logging to detect suspicious activity on /cgi-bin/cstecgi.cgi. 30 days: Upgrade all affected devices to the latest available firmware from Totolik; if no security patch is published, initiate replacement planning with hardware receiving active security support.

Totolink A8000RU CVE-2026-9477

Q: What is the CVSS score of CVE-2026-9477?

CVE-2026-9477 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-31710 HIGH

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-v665-872m-c6wh

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:41 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 20:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the 'mac' parameter sent to the setAccessDeviceCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and SSVC rates the technical impact as total with automatable exploitation, though EPSS remains modest at 0.89% (76th percentile). No CISA KEV listing has been published at time of analysis.

Technical ContextAI

The affected component is the Web Management Interface of the Totolink A8000RU SOHO/SMB router, exposed via the CGI handler /cgi-bin/cstecgi.cgi - a common attack surface across Totolink's product line that dispatches requests to internal C functions based on the 'topicurl' parameter. The setAccessDeviceCfg endpoint accepts a 'mac' argument that is concatenated into a system shell invocation without proper neutralization, matching CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CPE cpe:2.3:a:totolink:a8000ru identifies the affected firmware build, and similar cstecgi.cgi command injection patterns have historically plagued Totolink devices, indicating systemic input validation gaps in the vendor's CGI dispatch layer.

RemediationAI

No vendor-released patch identified at time of analysis - Totolink has not published a specific fixed firmware version in the available data, so administrators should monitor https://www.totolink.net/ for an updated build superseding 7.1cu.643_b20200521 and apply it as soon as available. As compensating controls, restrict access to the Web Management Interface to trusted management VLANs or specific admin IPs via the router's ACL settings (side effect: remote admin from arbitrary networks is broken), disable WAN-side HTTP/HTTPS administration entirely if currently enabled (side effect: requires LAN access for changes), and block external traffic to /cgi-bin/cstecgi.cgi at any upstream firewall or reverse proxy if the device is fronted by one. For high-risk deployments, consider replacing the device with a model receiving active security maintenance, since cstecgi.cgi has a recurring history of similar issues across Totolink firmware. Reference exploit and writeup: https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_349/README.md and https://vuldb.com/vuln/365458.