CVE Intelligence
Analysis AI-assisted

CVE-2026-9384: Totolink A8000RU OS command injection in Web Management cstecgi.cgi setDiagnosisCfg

VulDB has published CVE-2026-9384, an OS command injection in the Web Management Interface of the Totolink A8000RU, reached through the setDiagnosisCfg function of /cgi-bin/cstecgi.cgi. The CNA scores it 9.8 (critical) and the record states that a public exploit exists and could be used. The CVE is not listed in CISA KEV and the record lists no fixed version.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

VulDB published CVE-2026-9384 describing an OS command injection in the Web Management Interface of the Totolink A8000RU. According to the record, the setDiagnosisCfg function in /cgi-bin/cstecgi.cgi does not safely handle the ip argument, so injected operating system commands can be executed. The weakness is mapped to CWE-77.

Impact

  • The CNA assigns a CVSS base score of 9.8 (critical), with network attack vector, low complexity, no privileges and no user interaction, as stated in the record.
  • SSVC fields in the record indicate total technical impact and that the issue is automatable, with exploitation status recorded as poc.
  • If exploited, the vector in the record points to high impact on confidentiality, integrity and availability of the device.

Affected products and versions

  • Totolink A8000RU, version 7.1cu.643_b20200521, as listed in the record.
  • The record lists no other affected versions and no fixed version. Whether other firmware builds are affected is unknown.

Exploitation status

The VulDB description states that the exploit has been made public and could be used. The CVE is not listed in the CISA KEV catalog in this record, so no confirmed active exploitation is recorded in the sources consulted.

Remediation and mitigation

  • No fixed version is listed in the record. Treat remediation status as unknown and check the vendor site Totolink for firmware updates or advisories.
  • Remove the management interface from internet exposure and limit access to trusted administrative networks.
  • Disable remote management features that are not required.
  • Track vendor and VulDB updates for this CVE until a fix is confirmed.

Detection guidance

  • Review web server and device logs for unusual requests to the cstecgi.cgi endpoint, especially from unexpected sources.
  • Watch for unexpected system processes, configuration changes or outbound connections originating from the device.

Limitations of the available information

  • The record contains no fixed version, no vendor advisory and no vendor confirmation of affected builds.
  • CVSS scores differ between providers and versions in the record; the CNA score of 9.8 is the primary value shown.
  • The EPSS probability of 0.03253 is listed with a date that should be verified before use in prioritization.
  • The public exploit referenced in the record was not analyzed for this portal entry.

Frequently asked questions

Is CVE-2026-9384 being actively exploited?

The record does not list this CVE in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The VulDB description says a public exploit has been made available and could be used.

Which Totolink A8000RU version is affected?

The record lists version 7.1cu.643_b20200521. It does not list other affected versions or a fixed version, so check the vendor site for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.