CVE-2026-9385
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
A vulnerability was found in the Totolink A8000RU router firmware 7.1cu.643_b20200521. The setTracerouteCfg function in /cgi-bin/cstecgi.cgi improperly validates the command argument, enabling remote OS command injection.
Risk Assessment
A remote attacker can gain full control over the device, potentially compromising data confidentiality, integrity, and network availability.
Recommendation
Immediately update the router firmware and restrict management interface access to trusted IP addresses only.
Original NVD description (English source)
A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument command causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.