CVE Intelligence
Analysis AI-assisted

CVE-2026-9408: Totolink A8000RU OS Command Injection in Web Management Interface

CVE-2026-9408 is recorded as an OS command injection flaw in the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521, reached through the setStaticDhcpRules function. The record states that the attack can be performed remotely and that a public exploit exists. The CNA assigned a CVSS 3.1 score of 9.8 (Critical), and no confirmed active exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-9408 is recorded as an OS command injection in the Web Management Interface of the Totolink A8000RU, firmware 7.1cu.643_b20200521. The CNA is VulDB (cna@vuldb.com), and the weakness is classified as CWE-77, Command Injection. The sources cited are the VulDB entry and the NVD entry.

Impact

  • According to the CNA's CVSS 3.1 vector, the attack vector is network-based, no privileges or user interaction are required, and confidentiality, integrity and availability impacts are rated High.
  • If exploited, command injection on a router could allow an attacker to run operating system commands on the device. The actual effect depends on device configuration, which the record does not describe.

Affected products and versions

  • Confirmed in the record: Totolink A8000RU 7.1cu.643_b20200521.
  • The affected list in the record is empty, so other firmware versions are unknown.

Exploitation status

  • The record states that the exploit is public and may be used. This is not the same as confirmed active exploitation.
  • CISA KEV: not listed in the record. No confirmed active exploitation appears in the sources consulted.

Remediation and mitigation

  • The record contains no fixed version and no vendor patch reference. Check the Totolink website for firmware updates, noting that a fix there is not confirmed by the record.
  • Until an update is verified, restrict access to the management interface: do not expose it to the internet, limit it to trusted internal networks, and disable remote administration where possible.
  • Change default administrative credentials and monitor for unexpected configuration changes.

Detection guidance

  • Review device logs and configuration for unexpected changes to DHCP-related settings and for unknown administrative activity.
  • Monitor traffic to the device management port for unusual requests from unexpected sources.
  • Maintain an inventory of A8000RU devices and confirm the firmware version on each.

Limitations of the available information

  • The record does not list affected version ranges, fixed versions or vendor advisories.
  • The source status is shown as Deferred, so NVD-side analysis may be incomplete.
  • The CVSS 4.0 score of 8.9 and CVSS 2.0 score of 10 are provided by the CNA. No NVD-assigned score appears in the record.
  • Whether other Totolink models share this code is unknown.

Frequently asked questions

Is CVE-2026-9408 known to be actively exploited?

The sources consulted do not list it in CISA KEV and show no confirmed active exploitation. The record does state that a public exploit exists.

Which versions are affected?

The record names Totolink A8000RU firmware 7.1cu.643_b20200521. The affected list is empty, so other versions are unknown.

Is there a fixed version?

No fixed version is identified in the record. Check the vendor for updates and restrict access to the management interface in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.