CVE-2026-9435: Totolink A8000RU OS Command Injection in Web Management

Overview

The record describes a command injection weakness (CWE-77) in the Web Management Interface of the Totolink A8000RU, firmware 7.1cu.643_b20200521. The affected element is the setQosCfg function, where manipulation of the enable argument results in operating system command injection. The record also states that remote exploitation is possible and that an exploit is now public. See the NVD entry and the VulDB entry.

Impact

• The CVSS 3.1 vector recorded by the CNA (AV:N, AC:L, PR:N, UI:N, S:U, C:H, I:H, A:H) corresponds to a remotely reachable issue requiring no privileges or user interaction, with high confidentiality, integrity and availability impact.
• The CNA-assigned CVSS 3.1 base score is 9.8 and the CVSS 4.0 score is 8.9, both as recorded by the CNA.
• Successful command injection on a network device would typically allow an attacker to act with the device's privileges, which is an inference from the weakness class and not a statement made in the record.

Affected products and versions

The product and firmware string named in the record is Totolink A8000RU 7.1cu.643_b20200521. The structured affected-product list in the record is empty, so the full set of affected versions is unknown. Other firmware builds should not be assumed vulnerable or safe without vendor confirmation. The vendor site is available at Totolink.

Exploitation status

The record states that the exploit is now public and may be used. The record marks the CVE as not listed in CISA KEV. No confirmed active exploitation or exploitation in the wild appears in the sources consulted for this analysis. The EPSS probability recorded is 0.03253 with a percentile of 0.88053, which indicates a relatively high estimated exploitation likelihood compared with the broader CVE population, dated as shown in the record.

Remediation and mitigation

• The record does not identify a fixed version. The absence of a fixed version is not evidence that no fix exists; check the vendor site for firmware updates for the A8000RU line.
• Restrict access to the web management interface to trusted administrative networks, and do not expose it to the internet.
• Disable remote management features where they are not required.
• If no vendor fix is available, consider isolating or replacing the device, since a public exploit is recorded.
• Review and reset administrative credentials after applying any changes, as a precaution.

Detection guidance

• Review device and network logs for unexpected requests to the web management interface, especially from external or unfamiliar addresses.
• Monitor for unexpected changes to QoS or other configuration settings on the device.
• Watch for unusual outbound connections or processes originating from the router, which may indicate post-compromise activity.
• Compare firmware version strings against the vendor's current release notes to inventory exposed devices.

Limitations of the available information

• The structured list of affected and fixed versions is empty in the record.
• The record has no title and the source status is marked as Deferred.
• No vendor advisory from Totolink is cited in the record.
• The EPSS date in the record is later than the publication date, so the score should be interpreted with that date in mind.
• The public exploit is referenced in the record, but this analysis does not describe or assess its contents.

Frequently asked questions

Is CVE-2026-9435 being actively exploited?

The record states that a public exploit exists, but it is not listed in CISA KEV. No confirmed active exploitation appears in the sources consulted.

Which versions are affected and is there a fix?

The record names firmware 7.1cu.643_b20200521 but its structured affected and fixed version lists are empty. Check the vendor site for updates and do not assume other builds are safe or vulnerable.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.