CVE-2026-9477
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
In the Totolink A8000RU web management interface, the setAccessDeviceCfg function is vulnerable to OS command injection via the mac argument.
Risk Assessment
A remote attacker can execute arbitrary commands on the router, leading to full device compromise.
Recommendation
Update the router firmware and restrict access to the management interface.
Original NVD description (English source)
A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.