CVE-2026-9386
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
A vulnerability was identified in the Totolink A8000RU router firmware 7.1cu.643_b20200521. The setLanguageCfg function in /cgi-bin/cstecgi.cgi mishandles the lang argument, allowing remote OS command injection.
Risk Assessment
An attacker can remotely compromise the router, alter its configuration, intercept network traffic, or use it as a pivot for further attacks on the internal network.
Recommendation
Immediately update the router firmware to the latest version or apply temporary firewall rules to block external access to the management interface.
Original NVD description (English source)
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument lang leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.