Which versions of Totolink A8000RU are affected by EUVD-2026-31597?

The Totolink A8000RU router (firmware 7.1cu.643_b20200521) contains a critical unauthenticated remote code execution vulnerability (CVE-2026-9385, CVSS 8.9) that allows attackers to execute arbitrary…

Is there a public PoC exploit available for EUVD-2026-31597?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31597. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate EUVD-2026-31597?

Within 24 hours: Identify all Totolik A8000RU devices in production inventory, segment them from untrusted networks, and restrict WAN-facing access. Within 7 days: Disable remote management interfaces and implement network-based access controls to limit exposure; document business-critical devices requiring this hardware. Within 30 days: Contact Totolink for patch availability and timeline; if no patch is released, develop device replacement strategy and evaluate alternative router solutions with ongoing vendor support.

Totolink A8000RU EUVD-2026-31597

Q: What is the CVSS score of EUVD-2026-31597?

EUVD-2026-31597 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

| CVE-2026-9385 HIGH

OS Command Injection (CWE-78)

2026-05-24 VulDB

GHSA-j8qr-3593-h6q8

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:18 vuln.today

Severity Changed

May 26, 2026 - 19:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 19:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument command causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Remote OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows unauthenticated attackers to execute arbitrary operating system commands by manipulating the 'command' argument in the setTracerouteCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and the CVSS 4.0 vector confirms network-reachable, low-complexity exploitation without authentication or user interaction, though EPSS remains modest at 0.89% (76th percentile) and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in the Totolink A8000RU's Web Management Interface, specifically the cstecgi.cgi binary that handles administrative actions. The setTracerouteCfg handler accepts a 'command' parameter that is passed to an underlying shell invocation without proper sanitization or argument separation, manifesting CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The affected CPE (cpe:2.3:a:totolink:a8000ru) is consistent with a common pattern in TOTOLINK consumer/SOHO routers where multiple cgi-bin endpoints wrap traceroute, ping, and diagnostic utilities by concatenating user input into system() calls - an established weakness class in this product family.

RemediationAI

No vendor-released patch identified at time of analysis - TOTOLINK has not published an advisory or fixed firmware in the supplied references (https://vuldb.com/vuln/365348, https://www.totolink.net/). Until the vendor ships a fixed image, the most effective compensating control is to ensure the Web Management Interface is not exposed to the WAN (disable remote management in the router's administration settings); this is essentially free of side effects since remote admin is rarely needed. On the LAN side, restrict access to /cgi-bin/cstecgi.cgi via an upstream firewall or ACL so only a dedicated management host can reach it, accepting the trade-off that administrators must use that jump host. As a stronger control, replace affected A8000RU units with patched models or alternative firmware where supported, since the cstecgi.cgi attack surface has historically had recurring command injection findings across TOTOLINK devices.