CVE Intelligence
Analysis AI-assisted

CVE-2026-9433: Totolink A8000RU Web Management OS Command Injection

A command injection weakness (CWE-77) has been reported in the setMacFilterRules function of the web management interface of Totolink A8000RU firmware version 7.1cu.643_b20200521. The record states the issue can be triggered remotely and that a public exploit has been made available, with a CVSS 3.1 base score of 9.8 from the CNA VulDB. No CISA KEV listing or confirmed exploitation in the wild appears in the sources consulted, and no fixed version is listed in the record.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-9433 is a command injection weakness (CWE-77) in the web management interface of the Totolink A8000RU, specifically in the setMacFilterRules function reached through /cgi-bin/cstecgi.cgi. According to the record, manipulation of the argument enable allows operating system commands to be injected. The CNA is VulDB, and the record was published on 2026-05-25 with a status of Deferred in the source data.

Impact

  • The CNA-scored CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8 (critical).
  • The SSVC assessment in the record lists automatable as yes and technical impact as total.
  • Successful exploitation of an OS command injection flaw would generally allow an attacker to act with the privileges of the vulnerable service on the device. The exact impact on this firmware has not been verified in the sources consulted.

Affected products and versions

  • Totolink A8000RU, version 7.1cu.643_b20200521, as listed in the record.
  • The record provides no other affected versions and no fixed version.
  • Product information is available from the vendor at totolink.net.

Exploitation status

The CISA KEV catalog does not list this CVE. The record states that an exploit has been made available to the public, and a public repository is referenced. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.03253 (percentile 0.88056), and the SSVC exploitation value is poc.

Remediation and mitigation

  • The record does not identify a vendor fix. Check the vendor site for firmware updates and apply any update that addresses this component.
  • Until a fix is confirmed, restrict access to the web management interface: disable remote administration, limit management access to trusted internal networks, and place the device behind a firewall that does not expose the management port to the internet.
  • Change default administrative credentials and review device configuration for unexpected changes.
  • If the device cannot be patched or isolated, consider replacing it with a supported model.

Detection guidance

  • Review web management and access logs for requests to /cgi-bin/cstecgi.cgi from unexpected sources or with unusual parameters.
  • Monitor the device for unexpected outbound connections, new processes or configuration changes.
  • Track the vendor and VulDB entries for updates to the status of this issue.

Limitations of the available information

  • The record does not state any fixed version or vendor patch.
  • Whether the device is affected beyond the listed firmware build is unknown.
  • The record uses the phrase 'may be initiated remotely' without describing authentication conditions in detail; the vector indicates no privileges required, but the VulDB CTI page is referenced for permissions details that were not retrieved here.
  • The vendor advisory status was not confirmed in the sources consulted.

Frequently asked questions

Is CVE-2026-9433 being actively exploited?

The CISA KEV catalog does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit has been made available.

Which versions are affected?

The record lists Totolink A8000RU version 7.1cu.643_b20200521 only. No other versions or a fixed version are provided.

What should administrators do now?

Check the vendor for an update, restrict access to the web management interface, disable remote administration, and change default credentials until a fix is confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.