CVE-2026-9407: Totolink A8000RU OS Command Injection in setFirewallType (cstecgi.cgi)
A critical OS command injection flaw in the setFirewallType function of the Totolink A8000RU web management interface (firmware 7.1cu.643_b20200521) can be triggered remotely through the firewallType argument. The record reports a CVSS 3.1 score of 9.8 and a publicly disclosed exploit, but no fixed version is listed. No confirmed active exploitation appears in the sources consulted.
Overview
The record describes an OS command injection in the setFirewallType function of the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521, reachable through /cgi-bin/cstecgi.cgi. The weakness is classified as CWE-77 (Command Injection). Technical details are summarized in the VulDB entry.
Impact
- The CVSS 3.1 score of 9.8 assigned by the CNA (cna@vuldb.com) carries a vector indicating network attack, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
- The SSVC data in the record lists technical impact as total and automatable as yes.
- Successful exploitation would allow commands to run on the operating system of the device. The exact consequences depend on the device configuration and are not detailed in the record.
Affected products and versions
- Totolink A8000RU, version 7.1cu.643_b20200521 is the only version listed in the record.
- No other affected versions or ranges appear in the sources consulted. Whether other firmware builds are affected is unknown.
Exploitation status
- The record states that the exploit has been disclosed publicly and may be used. A third-party repository tagged as an exploit is listed among the references. Its content was not analyzed here.
- The CISA KEV catalog does not list this CVE, so no confirmed active exploitation appears in the sources consulted.
- The EPSS probability is recorded as 0.03253, with percentile 0.88048.
Remediation and mitigation
- No fixed version is listed in the record. The absence of a fix in the data does not confirm that none exists. Check the vendor site at Totolink for firmware updates.
- Remove the management interface from internet exposure and restrict access to trusted administrative networks.
- If no update is available, consider replacing or isolating the device and reviewing whether its administrative interface is reachable from untrusted segments.
- Prioritize this asset because of the critical score and the publicly disclosed exploit.
Detection guidance
- Review web server and device logs for requests to the cstecgi.cgi endpoint from unexpected sources, particularly those involving the firewall configuration function.
- Monitor for unexpected system activity or configuration changes on the device.
- Perimeter network monitoring can flag management-interface traffic originating outside trusted ranges.
Limitations of the available information
- The record does not provide a fixed version, a vendor advisory, or confirmed patch status.
- The record contains CVSS 4.0 scores of 9.3 and 8.9 from different providers, in addition to the CVSS 3.1 score of 9.8. Their differences are not explained.
- The record marks the source status as Deferred.
- Exploit details beyond the statements in the record are unknown.
Frequently asked questions
Is CVE-2026-9407 being actively exploited?
The CISA KEV catalog does not list this CVE, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been disclosed and may be used.
Which devices and versions are affected?
The record lists the Totolink A8000RU with firmware version 7.1cu.643_b20200521 as the only affected version. Whether other builds are affected is unknown from the available data.
Is there a fixed version?
No fixed version is listed in the record. Check the vendor website for firmware updates and treat the absence of a listed fix as unknown rather than as confirmation that no fix exists.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.