CVE-2026-9454

Critical

Published: 25/05/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521 affecting the function setOpenVpnCertGenerationCfg of the file /cgi-bin/cstecgi.cgi of the Web Management Interface. Manipulating the argument servername can lead to OS command injection.

Risk Assessment

An attacker may remotely exploit this vulnerability, posing a serious threat to the security of the system and the organization's data.

Recommendation

It is recommended to update the software to the latest version and monitor the system for unauthorized access attempts.

Original NVD description (English source)

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setOpenVpnCertGenerationCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument servername can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used.