CVE Intelligence
Analysis AI-assisted

CVE-2026-9385: Totolink A8000RU OS command injection in setTracerouteCfg

CVE-2026-9385 is an OS command injection flaw in the Web Management Interface of Totolink A8000RU version 7.1cu.643_b20200521, in the setTracerouteCfg function of /cgi-bin/cstecgi.cgi. VulDB rates it critical with a base score of 9.8 and states it can be exploited remotely. A public exploit is reported, but the CISA KEV catalog does not list this CVE, so no confirmed active exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-9385 is recorded as an OS command injection weakness (CWE-77) in the setTracerouteCfg function of /cgi-bin/cstecgi.cgi on Totolink A8000RU, version 7.1cu.643_b20200521. The record states that the command argument is manipulated and that the attack can be carried out remotely. The CNA is VulDB and the record status is Deferred.

Impact

  • The CVSS vector supplied by VulDB indicates high confidentiality, integrity and availability impact, with no privileges or user interaction required. The base score is 9.8.
  • SSVC data in the record lists technical impact as total and automatable as yes.
  • The real consequences in a given deployment depend on device exposure and configuration (inference).

Affected products and versions

  • Totolink A8000RU, version 7.1cu.643_b20200521, is the only version listed in the record.
  • The record does not list other affected builds, so whether other versions are affected is unknown.

Exploitation status

  • The record states that a public exploit has been disclosed and may be used. A GitHub reference is tagged as an exploit.
  • CISA KEV does not list this CVE, so no active exploitation is confirmed in the sources consulted.
  • SSVC exploitation is marked as poc (proof of concept).

Remediation and mitigation

  • No fixed version is listed in the record. The absence of a listed fix does not confirm that none exists. Check the vendor site for firmware updates: Totolink.
  • Restrict access to the web management interface to trusted networks and disable remote administration where it is not required.
  • Prioritize inventory of A8000RU devices because of the critical rating and the public exploit.

Detection guidance

  • Review web management logs for unexpected requests to cstecgi.cgi, particularly those touching the traceroute configuration function.
  • Monitor the device for unexpected outbound connections or unauthorized configuration changes.

Limitations of the available information

  • The record lists no fixed version and its status is Deferred.
  • The exploit referenced in the record was not analyzed here, and the exact vulnerable code path is not verified.
  • Affected versions beyond the single listed build are unknown.

Frequently asked questions

Is CVE-2026-9385 being actively exploited?

The record says a public exploit has been disclosed, but CISA KEV does not list this CVE. No confirmed active exploitation appears in the sources consulted.

Which versions are affected?

The record lists only Totolink A8000RU version 7.1cu.643_b20200521. Other builds are not confirmed as affected.

Is there a fix available?

The record lists no fixed version. Check the vendor site for firmware updates and apply them if available.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.