CVE Intelligence
Analysis AI-assisted

CVE-2026-9434: Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg OS command injection

CVE-2026-9434 is a critical OS command injection (CWE-77) in the Web Management Interface of the Totolink A8000RU firmware 7.1cu.643_b20200521. The record states that manipulating the wscDisabled argument of the setWiFiWpsCfg function in /cgi-bin/cstecgi.cgi can be done remotely and that a public exploit has been disclosed. No confirmed active exploitation and no fixed version appear in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-9434 describes an OS command injection weakness (CWE-77) in the Web Management Interface of the Totolink A8000RU, firmware version 7.1cu.643_b20200521. According to the record, the problem is in the setWiFiWpsCfg function of /cgi-bin/cstecgi.cgi, and manipulation of the wscDisabled argument leads to command injection. The entry was published by VulDB as a CNA on 2026-05-25 and its NVD status is recorded as Deferred.

Impact

The CVSS 3.1 vector recorded by VulDB and the CNA is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8 (critical). This vector indicates network attack vector, low complexity, no privileges and no user interaction required, with high confidentiality, integrity and availability impact. A CVSS 4.0 score of 9.3 from VulDB and 8.9 from the CNA is also recorded. An attacker able to reach the management interface could, in principle, run operating system commands on the device.

Affected products and versions

  • Totolink A8000RU, version 7.1cu.643_b20200521 (the only product and version listed in the record).
  • Component: Web Management Interface, function setWiFiWpsCfg in /cgi-bin/cstecgi.cgi.

The record does not list any fixed version. The vendor website is referenced as Totolink, but no vendor advisory for this CVE was found in the sources consulted.

Exploitation status

  • The CVE is not listed in the CISA KEV catalog in the record, so no confirmed active exploitation is recorded for it.
  • The record states that the exploit has been disclosed publicly and may be used. A third-party repository tagged as exploit is referenced by the record; its contents were not analysed here.
  • The EPSS probability is 0.03253 (percentile 0.88054). The SSVC fields in the record show exploitation at the proof-of-concept level, automatable as yes and technical impact as total.
  • No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Check the vendor website and the VulDB entry for any firmware update. No fixed version is listed in the record, so treat the status as unknown until a vendor statement is confirmed.
  • Restrict access to the web management interface. Do not expose it to the internet, and limit it to trusted administrative networks or VPN.
  • Disable remote management features if they are not required.
  • If the device cannot be updated or isolated, consider replacing it with a supported model, since the record gives no fixed version.
  • Review device exposure across the estate, and prioritise devices that are reachable from untrusted networks.

Detection guidance

  • Review web server and device logs for unusual or unexpected requests to /cgi-bin/cstecgi.cgi, especially those referencing the Wi-Fi WPS configuration function.
  • Monitor for unexpected outbound connections or configuration changes originating from the device.
  • Alert on access to the management interface from addresses outside approved administrative ranges.
  • Keep an inventory of A8000RU devices and their firmware versions to support rapid triage.

Limitations of the available information

  • No fixed or patched version is present in the record.
  • No vendor advisory was located in the sources consulted.
  • The record shows multiple CVSS versions and providers with differing scores; these are reported as recorded and not reconciled.
  • The NVD status is Deferred, and the EPSS date in the record is not verified here.
  • Whether the issue is exploitable in every deployment configuration is unknown from the record.

Frequently asked questions

What is CVE-2026-9434?

It is an OS command injection weakness (CWE-77) in the Web Management Interface of the Totolink A8000RU firmware 7.1cu.643_b20200521, in the setWiFiWpsCfg function of /cgi-bin/cstecgi.cgi.

Is this vulnerability being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted. The record does say a public exploit has been disclosed.

Is there a fixed version?

No fixed version is listed in the record. The status is unknown until the vendor confirms a fix.

What should administrators do now?

Restrict access to the management interface, disable remote management if not needed, check the vendor for updates, and monitor logs for unusual requests to the affected endpoint.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.