CVE Intelligence
Analysis AI-assisted

CVE-2026-9406: Totolink A8000RU cstecgi.cgi setRemoteCfg OS command injection

CVE-2026-9406 is an OS command injection weakness (CWE-77) in the Web Management Interface of the Totolink A8000RU, version 7.1cu.643_b20200521. The record describes it as remotely exploitable, with CVSS 3.1 base score 9.8 from VulDB, and states that an exploit has been made public. No vendor fix is listed in the sources consulted, so affected devices need interim hardening and isolation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a weakness in the Web Management Interface of the Totolink A8000RU router, firmware version 7.1cu.643_b20200521. The affected function is setRemoteCfg, reached through /cgi-bin/cstecgi.cgi. According to the record, manipulating the enable argument can lead to operating system command injection (CWE-77). The source is VulDB, listed in the VulDB entry and the NVD record.

Impact

  • The record rates the technical impact as total, and the CVSS 3.1 vector indicates high confidentiality, integrity and availability impact with no privileges or user interaction required.
  • A successful command injection on a network device would generally allow an attacker to run commands with the privileges of the vulnerable service. The exact privilege level on this device is unknown from the record.
  • The CVSS 4.0 scores in the record (9.3 from VulDB and 8.9 from the CNA) point to a similarly severe rating under the newer method.

Affected products and versions

  • Totolink A8000RU, version 7.1cu.643_b20200521, is the only version listed in the record.
  • The record provides no range of affected versions and no information about other firmware builds or hardware revisions.
  • No fixed version is listed in the record. This does not mean no fix exists; it means the sources consulted do not provide one.

Exploitation status

The record states that an exploit has been made publicly available and could be used for attacks. The CISA KEV flag for this CVE is false, so the sources consulted do not report confirmed active exploitation. The SSVC data in the record lists exploitation as proof-of-concept and automatable as yes. The EPSS probability is 0.03253 with a percentile of 0.88052.

Remediation and mitigation

  • Check the Totolink website and vendor support channels for firmware updates that address this issue. No fix is confirmed in the sources consulted.
  • Do not expose the web management interface to the internet. Restrict access to trusted administrative networks and disable remote management if it is not required.
  • Place affected devices behind a firewall and segment them from sensitive internal systems.
  • If no vendor fix is available, consider replacing the device with a supported model, since an unpatched command injection in an internet-facing router carries long-term risk.
  • Change default administrative credentials and review accounts with access to the management interface.

Detection guidance

  • Review web server and device logs for unexpected requests to the management interface, particularly to the cstecgi.cgi endpoint, from unfamiliar sources.
  • Monitor for configuration changes to remote management settings that were not made by administrators.
  • Watch for unexpected outbound connections or new processes on the device if your monitoring allows it.
  • Treat any unexplained change to device configuration as a potential indicator of compromise and investigate accordingly.

Limitations of the available information

  • The record does not list a vendor advisory, a fixed firmware version or a patch.
  • Only one affected version is documented, so other firmware builds may or may not be affected; this is unknown.
  • The record's source status is Deferred, and the EPSS date field is later than the publication date, so the scoring data should be re-checked against current sources.
  • The sources consulted do not confirm any real-world exploitation.

Frequently asked questions

What is the core weakness in CVE-2026-9406?

The record describes an OS command injection (CWE-77) in the setRemoteCfg function of /cgi-bin/cstecgi.cgi, triggered by manipulating the enable argument.

Is a fix available for CVE-2026-9406?

No fixed version is listed in the sources consulted. The absence of a listed fix does not confirm that none exists, so check the vendor for updates.

Is this CVE confirmed as actively exploited?

No. The record says a public exploit exists, but the CISA KEV flag is false and the sources consulted do not confirm active exploitation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.