CVE Intelligence
Analysis AI-assisted

CVE-2026-9404: Totolink A8000RU Web Management setDdnsCfg OS Command Injection

The Totolink A8000RU firmware 7.1cu.643_b20200521 contains an OS command injection flaw in the setDdnsCfg function of its web management interface. The record describes remote exploitation, a publicly available exploit, and a critical severity rating.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A command injection weakness (CWE-77) was reported in the Web Management Interface of the Totolink A8000RU, version 7.1cu.643_b20200521. The issue is in the setDdnsCfg function reached through /cgi-bin/cstecgi.cgi, where the provider argument is handled unsafely. The record states that the attack may be launched remotely. Technical details are listed in the VulDB entry.

Impact

  • Successful exploitation could allow an attacker to run operating system commands on the affected device.
  • The CNA-supplied CVSS 3.1 base score is 9.8 (Critical), with high confidentiality, integrity and availability impact in the vector.
  • CVSS 4.0 scores of 9.3 (VulDB) and 8.9 (CNA) are also recorded.

Affected products and versions

  • The record lists one affected product and version: Totolink A8000RU, version 7.1cu.643_b20200521.
  • No fixed version is listed. This does not confirm that no fix exists, and the vendor site is listed as a product reference.

Exploitation status

  • The record states that a public exploit is available and might be used.
  • This CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation is reported in the sources consulted.
  • The SSVC exploitation value is poc, meaning proof-of-concept activity is the stated level.
  • The EPSS probability is 0.03253 with a percentile of 0.88051.

Remediation and mitigation

  • Identify whether any deployed devices are A8000RU units running the affected firmware, and check the vendor website for an updated firmware release.
  • Limit access to the web management interface: do not expose it to the internet, restrict it to trusted internal networks or a VPN, and disable remote administration where it is not required.
  • If no vendor fix is confirmed, consider isolating affected devices and reviewing their configuration and exposure regularly.

Detection guidance

  • Review web server and device logs for unexpected requests to the management CGI endpoint, especially from unknown or external sources.
  • Monitor for unexpected outbound connections, new processes, or changes to dynamic DNS settings on the device.
  • Alert on administrative activity that does not match known maintenance windows.

Limitations of the available information

  • The record does not list a fixed firmware version or a vendor advisory.
  • The CVSS 3.1 and 4.0 scores come from different providers, and the record does not explain the differences.
  • The record does not state whether other firmware builds or device models are affected.
  • Whether the vendor has acknowledged or patched this issue is unknown from the sources provided.

Frequently asked questions

Is this Totolink A8000RU vulnerability being actively exploited?

This CVE is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit is available and might be used.

Which versions are affected?

The record lists only Totolink A8000RU version 7.1cu.643_b20200521. Other firmware versions are not addressed in the available information.

What should administrators do now?

Restrict access to the web management interface, avoid exposing it to the internet, check the vendor site for updated firmware, and monitor devices for unexpected activity while no confirmed fix is available.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.