CVE-2026-9454

CriticalCVSS 9.8

Published: 25/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.91%

78th percentile - higher than 78% of all known CVEs

Summary

In the Totolink A8000RU web management interface, the setOpenVpnCertGenerationCfg function is vulnerable to OS command injection via the servername argument.

Risk Assessment

A remote attacker can execute arbitrary commands on the router, leading to device takeover.

Recommendation

Update the router firmware and restrict access to the admin panel.

Original NVD description (English source)

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setOpenVpnCertGenerationCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument servername can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used.