CVE-2026-9404
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
A vulnerability was identified in the web management interface of Totolink A8000RU, allowing OS command injection. It affects the setDdnsCfg function in /cgi-bin/cstecgi.cgi, where the provider argument is not properly sanitized. The attack can be performed remotely and the exploit is public.
Risk Assessment
A remote attacker can change DDNS settings, potentially leading to traffic redirection or device takeover.
Recommendation
Immediately update the router firmware or apply firewall rules to block external access to the management interface.
Original NVD description (English source)
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument provider leads to os command injection. The attack may be launched remotely. The exploit is publicly available and might be used.