CVE-2026-9434

Critical

Published: 25/05/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521, affecting the setWiFiWpsCfg function in the /cgi-bin/cstecgi.cgi file of the Web Management Interface. Manipulation of the wscDisabled argument leads to OS command injection.

Risk Assessment

An attacker can remotely exploit this vulnerability, posing a serious threat to the security of the device and the network it is installed in.

Recommendation

It is recommended to update the device firmware to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Original NVD description (English source)

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setWiFiWpsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument wscDisabled leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.