CVE-2026-9408
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
A vulnerability was detected in the web management interface of Totolink A8000RU, allowing OS command injection. It affects the setStaticDhcpRules function in /cgi-bin/cstecgi.cgi, where the enable argument is not properly sanitized. The attack can be performed remotely and the exploit is public.
Risk Assessment
A remote attacker can modify static DHCP assignments, potentially leading to man-in-the-middle attacks or device takeover.
Recommendation
Immediately update the router firmware or apply firewall rules to block external access to the management interface.
Original NVD description (English source)
A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument enable results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.