CVE-2026-9432: Totolink A8000RU OS Command Injection in Web Management Interface
Totolink A8000RU firmware 7.1cu.643_b20200521 has an OS command injection flaw (CWE-77) in its web management interface, which VulDB reports can be exploited remotely. The CNA rates it 9.8 under CVSS 3.1, and the description states that an exploit has been publicly released. The record lists no fixed version and the CVE is not in CISA KEV.
Overview
This record describes an OS command injection flaw (CWE-77) in the web management interface of Totolink A8000RU firmware 7.1cu.643_b20200521. The CNA is VulDB, and the record was published on 2026-05-25 with source status Deferred.
Impact
According to the record, manipulating an argument handled by the web management interface results in OS command injection, and the attack can be launched remotely. The CNA scores the issue 9.8 under CVSS 3.1 and 8.9 under CVSS 4.0. If exploited, OS command injection would generally allow an attacker to run commands on the underlying device, which is an inference from the weakness type and not a confirmed outcome for this product.
Affected products and versions
The record names one product version: Totolink A8000RU 7.1cu.643_b20200521. The affected and fixes fields are empty, so no additional version ranges or fixed builds are confirmed. Check the Totolink website for firmware information.
Exploitation status
The record shows the CVE is not listed in CISA KEV. The description states that an exploit has been released to the public and may be used for attacks. No confirmed exploitation appears in the sources consulted. The EPSS probability of 0.03253 (percentile 0.88058) is a modeled likelihood and does not show observed exploitation.
Remediation and mitigation
- The record lists no fixed version. This does not prove that no fix exists, so check the vendor for firmware updates.
- Remove any internet exposure of the management interface and limit access to a trusted administrative network.
- Disable remote administration if it is not required.
- Change default or weak administrative credentials and review who has access.
- If no vendor fix becomes available, plan replacement or isolation of the device, since support status is unknown.
Detection guidance
- Review web management logs for unexpected or unusual requests to the management CGI endpoint.
- Maintain an inventory to identify all A8000RU devices and their firmware builds.
- Monitor for unexpected outbound connections or configuration changes originating from these devices, where logging is available.
Limitations of the available information
- The record gives no affected version range beyond the single build named.
- No fixed version, vendor advisory or vendor-supplied workaround is present in the record.
- The record includes a CNA-provided CVSS 3.1 score and no NVD-assigned score is shown.
- Whether the product is still supported by the vendor is unknown.
- The EPSS date in the record is later than the publication date and should be verified against the source before relying on it.
Frequently asked questions
Is this vulnerability being actively exploited?
The CVE is not listed in CISA KEV. The description says a public exploit has been released, but no confirmed exploitation appears in the sources consulted.
Which product and version are affected?
The record names only Totolink A8000RU firmware 7.1cu.643_b20200521. No other affected version ranges are provided.
Is a fixed version available?
The record lists no fixed version. That absence does not confirm that no fix exists, so check the vendor for firmware updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.