CVE Catalog
CVE-2026-9478
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk1.91%
78th percentile - higher than 78% of all known CVEs
Summary
In the Totolink A8000RU web management interface, the setParentalRules function is vulnerable to OS command injection via the enable argument.
Risk Assessment
A remote attacker can execute arbitrary commands on the router, leading to device takeover.
Recommendation
Update the router firmware and restrict access to the admin panel.
Original NVD description (English source)
A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.