CVE-2026-9432

Critical

Published: 25/05/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521 in the function setWiFiAdvancedCfg of the file /cgi-bin/cstecgi.cgi in the Web Management Interface. Manipulation of the argument bgProtection results in OS command injection.

Risk Assessment

This vulnerability allows for remote attacks, posing a serious threat to system security. A publicly available exploit may be used by attackers.

Recommendation

It is recommended to update the software to the latest version to eliminate this vulnerability. Additionally, monitor systems for unauthorized access attempts.

Original NVD description (English source)

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setWiFiAdvancedCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument bgProtection results in os command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.