CVE-2026-9433
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
A weakness was identified in the web management interface of Totolink A8000RU, allowing OS command injection. It affects the setMacFilterRules function in /cgi-bin/cstecgi.cgi, where the enable argument is not properly sanitized. The attack can be initiated remotely and the exploit is public.
Risk Assessment
A remote attacker can bypass MAC filtering and gain unauthorized network access, as well as take control of the device.
Recommendation
Update the router firmware as soon as possible or restrict management interface access to trusted IP addresses only.
Original NVD description (English source)
A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument enable causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.