CVE-2026-9387: Totolink A8000RU Command Injection via setUpgradeFW resetFlags Argument
CVE-2026-9387 is a command injection flaw in the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521, reached through the setUpgradeFW function of /cgi-bin/cstecgi.cgi. The record states that the resetFlags argument can be manipulated to run OS commands and that the attack can be launched remotely. The CNA reports a CVSS 3.1 score of 9.8 and notes that the exploit has been publicly released, but CISA KEV does not list it.
Overview
CVE-2026-9387 affects the Web Management Interface of the Totolink A8000RU, specifically version 7.1cu.643_b20200521. According to the record, the flaw is in the setUpgradeFW function of /cgi-bin/cstecgi.cgi, where the resetFlags argument is not handled safely, leading to OS command injection (CWE-77). The vulnerability was published on 2026-05-24 and the CNA is VulDB.
Impact
- The CNA assigns a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low complexity, no privileges and no user interaction required.
- If exploited, the record indicates potential high impact on confidentiality, integrity and availability of the device.
- Command injection on network devices can allow an attacker to control the device and use it as a foothold in the local network.
Affected products and versions
- Totolink A8000RU, version 7.1cu.643_b20200521, is the only version identified in the record.
- The record does not contain structured affected or fixed version data, so other firmware versions cannot be confirmed as affected or unaffected.
Exploitation status
- The record states that an exploit has been released to the public and may be used for attacks.
- The CISA KEV catalog does not list this CVE, so no confirmed active exploitation is recorded in the KEV data consulted.
- The EPSS probability is 0.03253 (percentile 0.88055), which is an estimate of exploitation likelihood and not a confirmation of exploitation.
Remediation and mitigation
- No vendor fix or patched firmware version is identified in the record. The absence of fix data does not mean no fix exists.
- Check the vendor site for firmware updates for the A8000RU: Totolink.
- Until a fix is verified, restrict access to the device's web management interface, keep it off the internet, and place it behind network controls that limit administrative access to trusted hosts.
- Review whether the device is still supported by the vendor and plan replacement if no security update is available.
Detection guidance
- Monitor for unexpected administrative requests to the web management interface, especially requests to the cstecgi.cgi endpoint.
- Review device logs and configuration for unauthorized changes, new accounts or unexpected outbound connections.
- Track firmware versions across the fleet to identify devices still running 7.1cu.643_b20200521.
Limitations of the available information
- The record does not include vendor advisory text, a patched version, or detailed technical analysis beyond the description.
- The exploit publication is mentioned but its contents are not part of this analysis and are not described here.
- The CVSS data comes from the CNA; no NVD-assigned score is present in the record.
Frequently asked questions
What is CVE-2026-9387?
It is a command injection vulnerability in the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521, reached through the setUpgradeFW function.
Is this vulnerability being actively exploited?
The record says a public exploit exists, but CISA KEV does not list this CVE, so no confirmed active exploitation appears in the sources consulted.
Is there a fix available?
The record does not identify a fixed version. Check the vendor site and restrict access to the management interface until a verified update is available.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.