CVE Intelligence
Analysis AI-assisted

CVE-2026-9386: Totolink A8000RU Command Injection in Web Management cstecgi.cgi setLanguageCfg

A command injection flaw (CWE-77) has been reported in the setLanguageCfg function of the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521. The record states that the lang argument can be manipulated remotely to run OS commands and that a public exploit is available. VulDB, as CNA, scores it CVSS 3.1 9.8 (Critical), and no fixed version is listed in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an OS command injection weakness in the setLanguageCfg function of the Web Management Interface of the Totolink A8000RU, firmware 7.1cu.643_b20200521. The issue is classified as CWE-77 and was published with VulDB as the CNA. The sources consulted describe it as reachable remotely.

Impact

  • The CVSS 3.1 vector recorded by VulDB is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which corresponds to a score of 9.8 with high impact on confidentiality, integrity and availability, and no privileges or user interaction required.
  • The SSVC data in the record lists technical impact as total and automatable as yes.
  • Command injection usually allows commands to run on the device with the privileges of the vulnerable component. This is an inference, because the sources do not describe the resulting privilege level.

Affected products and versions

  • Product: Totolink A8000RU.
  • Version listed: 7.1cu.643_b20200521.
  • No other affected versions are listed in the record. Whether other firmware builds or models are affected is unknown.

Exploitation status

  • The CISA KEV catalog does not list this CVE according to the record.
  • The record states that an exploit is publicly available. SSVC exploitation is recorded as poc (proof of concept).
  • No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • No fixed version is listed in the record. The absence of a listed fix does not mean no fix exists, so check the Totolink website and the VulDB entry for updates.
  • Until a vendor update is verified, restrict access to the web management interface and remove exposure to untrusted networks.
  • Where no fix is available, plan replacement or retirement of unsupported devices.

Detection guidance

  • Review web server and device logs for unusual requests to the management CGI endpoint and for unexpected values in language-related parameters.
  • Monitor devices for unexpected outbound connections, new processes or configuration changes.
  • Maintain an inventory of A8000RU devices and their firmware builds.

Limitations of the available information

  • The record contains no fixed version and no vendor advisory.
  • Whether other Totolink models or firmware builds are affected is unknown.
  • The record gives an EPSS probability of 0.03253 and a percentile of 0.88055; these values should be interpreted with care.
  • Sources consulted: NVD and VulDB entry.

Frequently asked questions

What is the vulnerability in CVE-2026-9386?

It is an OS command injection weakness (CWE-77) in the setLanguageCfg function of the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521. The record says the lang argument can be manipulated to run OS commands.

Is this CVE confirmed as actively exploited?

No. The CISA KEV catalog does not list it in the record, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit is available.

Is there a fixed version?

The record lists no fixed version. That does not prove a fix is absent, so check the vendor website and the VulDB entry for updates, and restrict access to the management interface in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.