CVE Intelligence
Analysis AI-assisted

CVE-2026-9405: Totolink A8000RU web interface OS command injection in setGameSpeedCfg

A command injection flaw (CWE-77) affects the Web Management Interface of the Totolink A8000RU router running version 7.1cu.643_b20200521. The record reports that remote exploitation is possible and that a public exploit has been released, with a CVSS 3.1 base score of 9.8 from VulDB. No confirmed exploitation in the wild appears in the sources consulted, and no fixed version is listed.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A command injection weakness (CWE-77) has been reported in the Web Management Interface of the Totolink A8000RU router, version 7.1cu.643_b20200521. According to the record, the issue is in the setGameSpeedCfg handler of the cstecgi.cgi web component, where a user-supplied argument reaches operating system command execution. Remote exploitation is listed as possible.

Impact

  • Successful exploitation could allow an attacker to run operating system commands on the device with the privileges of the affected web service.
  • The record gives a CVSS 3.1 base score of 9.8 (critical) from VulDB, reflecting a network attack vector, low complexity, no privileges required and no user interaction.
  • In that vector, confidentiality, integrity and availability impacts are all rated high.

Affected products and versions

  • Totolink A8000RU, version 7.1cu.643_b20200521, as listed in the record.
  • No other affected versions are listed in the sources consulted.
  • No fixed version is listed in the record. This does not confirm that no fix exists.

Exploitation status

  • The record states that an exploit has been publicly released. A GitHub repository tagged as an exploit is among the listed references.
  • The CISA KEV catalog does not list this CVE, so no confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability is 0.03253 (percentile 0.88052), and the SSVC exploitation state is recorded as proof of concept.

Remediation and mitigation

  • Check the vendor website for firmware updates for the A8000RU. The record does not list a fix.
  • Restrict access to the web management interface to trusted internal networks and disable remote administration from the internet.
  • Isolate affected devices through network segmentation and monitor them closely until a verified fix is applied.
  • If no update is available, plan replacement with a device that still receives security support.

Detection guidance

  • Review web management access logs for unexpected requests from unknown sources.
  • Monitor the device for unusual outbound connections or unexpected configuration changes.
  • Identify any instances of this model that are reachable from untrusted networks.

Limitations of the available information

  • The record lists no fixed versions, vendor advisories or additional affected versions.
  • Exploitation technique details are intentionally omitted from this analysis.
  • Scores come from VulDB as the CNA and other providers; they were not independently verified.
  • The EPSS date in the record is unusual and should be checked against the original source.

Frequently asked questions

Is CVE-2026-9405 being exploited in the wild?

The CISA KEV catalog does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit has been released.

Is there a fixed version for the Totolink A8000RU affected by this issue?

The record does not list any fixed version. Check the vendor website for firmware updates, since the absence of a listed fix does not confirm that none exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.