CVE-2026-9457
CriticalSummary
A vulnerability was identified in Totolink A8000RU version 7.1cu.643_b20200521 that allows remote command injection through manipulation of the FileName argument in the UploadFirmwareFile function of the /cgi-bin/cstecgi.cgi web management interface.
Risk Assessment
An attacker can remotely exploit this vulnerability, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update the firmware to the latest version and monitor the system for unauthorized activities.
Original NVD description (English source)
A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.