CVE-2026-9388: Totolink A8000RU OS Command Injection in cstecgi.cgi setScheduleCfg
A weakness in the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521 allows OS command injection through the setScheduleCfg function in /cgi-bin/cstecgi.cgi. VulDB rates it critical with CVSS 3.1 score 9.8 and describes remote attack. The record states a public exploit exists, but the CVE is not in CISA KEV and no fixed version is listed.
Overview
A weakness in the web management interface of the Totolink A8000RU, version 7.1cu.643_b20200521, is classified as OS command injection (CWE-77). The function setScheduleCfg in /cgi-bin/cstecgi.cgi handles the mode argument in a way that can allow injected operating system commands. The CNA VulDB states that the attack can be launched remotely.
Impact
- The CVSS 3.1 vector published by VulDB (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates confidentiality, integrity and availability impacts as high, with no privileges or user interaction required.
- VulDB's SSVC data lists technical impact as total and automatable as yes.
- Successful OS command injection generally lets an attacker act with the privileges of the vulnerable component on the device, so the practical impact depends on the device configuration.
Affected products and versions
- Totolink A8000RU, version 7.1cu.643_b20200521 (the only version listed in the record).
- No fixed version is listed in the sources consulted. This does not prove that no fix exists.
Exploitation status
- This CVE is not listed in the CISA KEV catalog in the record, so no active exploitation is confirmed by that source.
- The description states that an exploit has been made publicly available, and SSVC exploitation is recorded as proof of concept.
- No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Check the Totolink website for a firmware update that addresses this issue, since no fixed version is listed in the record.
- Keep the web management interface off the internet and limit access to trusted administrative networks.
- Disable remote management if it is not required.
- If no fix becomes available, plan to replace or isolate the device from sensitive networks.
Detection guidance
- Review web access logs for requests to /cgi-bin/cstecgi.cgi that come from unexpected sources or at unusual times.
- If device logs are available, look for unexpected system processes, configuration changes to scheduling settings, or unusual outbound connections.
- The VulDB CTI page lists a signature tag, which may help teams check for related activity in their tooling.
Limitations of the available information
- The record lists no vendor advisory and no fixed version.
- It is unknown whether other Totolink firmware builds are affected.
- CVSS 4.0 scores differ between providers (9.3 from VulDB and 8.9 from the CNA), so the severity under that version should be read with care.
- Exploit availability is stated, but the record does not show how widely it is used.
Frequently asked questions
What is CVE-2026-9388?
It is an OS command injection weakness in the setScheduleCfg function of /cgi-bin/cstecgi.cgi in the web management interface of Totolink A8000RU firmware 7.1cu.643_b20200521, according to VulDB.
Can it be exploited remotely?
The VulDB description states that the attack can be launched remotely, and the CVSS 3.1 vector lists network attack vector with no privileges or user interaction required.
Is there a fix?
The record lists no fixed version and no vendor advisory. Check the Totolink website for updates, and treat the absence of a listed fix as unknown rather than as proof that none exists.
Is it known to be actively exploited?
The CVE is not listed in CISA KEV in the record, and no confirmed exploitation in the wild appears in the sources consulted. The description says a public exploit exists.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.