CVE-2026-9384
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
A vulnerability was discovered in the Totolink A8000RU router firmware 7.1cu.643_b20200521. The setDiagnosisCfg function in /cgi-bin/cstecgi.cgi fails to properly sanitize the ip argument, allowing remote OS command injection.
Risk Assessment
An attacker can remotely take over the router, potentially leading to data theft, malware installation, or inclusion of the device in a botnet.
Recommendation
Immediately update the router firmware and consider disabling remote management access if not required.
Original NVD description (English source)
A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument ip results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used.