CVE-2026-9406
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
A weakness was identified in the web management interface of Totolink A8000RU, allowing OS command injection. It affects the setRemoteCfg function in /cgi-bin/cstecgi.cgi, where the enable argument is not properly sanitized. The attack can be initiated remotely and the exploit is public.
Risk Assessment
A remote attacker can enable remote management or alter configuration, leading to full device compromise.
Recommendation
Update the router firmware as soon as possible or restrict management interface access to trusted IP addresses only.
Original NVD description (English source)
A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setRemoteCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.