CVE-2026-9434
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
A security vulnerability was found in the web management interface of Totolink A8000RU, leading to OS command injection. It affects the setWiFiWpsCfg function in /cgi-bin/cstecgi.cgi, where the wscDisabled argument is mishandled. The attack can be launched remotely and the exploit is public.
Risk Assessment
A remote attacker can take control of the router, allowing modification of Wi-Fi settings and traffic interception.
Recommendation
Immediately update the router firmware or disable remote access to the management interface until the vulnerability is patched.
Original NVD description (English source)
A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setWiFiWpsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument wscDisabled leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.