CVE-2026-9436
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
A vulnerability has been found in the Totolink A8000RU router version 7.1cu.643_b20200521, allowing OS command injection via the setL2tpServerCfg function in /cgi-bin/cstecgi.cgi by manipulating the enable argument. The attack can be executed remotely, and an exploit has been published.
Risk Assessment
The organization is at risk of remote takeover of the router, potentially leading to network compromise, traffic interception, or further attacks on internal assets.
Recommendation
Immediately update the Totolink A8000RU firmware to the latest available version or apply temporary mitigations such as restricting management interface access to trusted IP addresses only.
Original NVD description (English source)
A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used.