CVE Intelligence
Analysis AI-assisted

CVE-2026-9436: Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg OS command injection

A critical OS command injection flaw (CWE-77) affects the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521. The record describes remote exploitation through the setL2tpServerCfg function and states that an exploit has been published. No fixed version is listed, so mitigation centers on restricting access to the management interface.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A command injection flaw (CWE-77) was reported in the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521. The issue involves the setL2tpServerCfg function exposed through /cgi-bin/cstecgi.cgi, where manipulation of the enable argument can lead to operating system command injection. The entry was published by VulDB, and the record states that a public exploit has been released.

Impact

The record describes the attack as remotely executable. The CVSS 3.1 base score of 9.8 (critical) from VulDB and its CNA rates confidentiality, integrity and availability impacts as high. On an embedded device, successful command injection would typically let an attacker run commands with the privileges of the web service. This is an inference from the weakness class, not a statement made in the sources.

Affected products and versions

  • Totolink A8000RU, version 7.1cu.643_b20200521 (the only version listed in the record)
  • No other versions or hardware revisions are listed in the sources consulted.
  • The record contains no fixed version.

Exploitation status

The record states that an exploit has been published and may be used. The CISA KEV catalog does not list this CVE, and the SSVC exploitation field is set to poc (proof of concept). No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • The record lists no vendor fix. Check the vendor site at https://www.totolink.net/ for firmware updates and apply any update that addresses this component.
  • If no fix is available, restrict access to the web management interface: avoid exposing it to the internet, limit it to trusted management networks, and disable remote management where possible.
  • Review device configurations and confirm that the L2TP server feature is disabled if it is not required.
  • Where devices no longer receive vendor updates, plan replacement. This is general guidance, not a fact stated in the record.

Detection guidance

  • Monitor access logs and network traffic to the management interface, especially requests from unexpected sources.
  • Look for unexpected configuration changes on the device and unusual outbound connections originating from it.
  • Track updates to the VulDB entry and the NVD record, since the source status is listed as Deferred and details may change.

Limitations of the available information

The record does not include a vendor advisory, a fixed version or an official patch. The exact request format is intentionally not described here. The EPSS values in the record (probability 0.03456, percentile 0.88759, dated 2026-10-13) should be verified against the source before use. Whether the flaw is reachable depends on device configuration, which the sources do not describe.

Frequently asked questions

Is this CVE being actively exploited?

The CISA KEV catalog does not list this CVE. The record says a public exploit has been published and the SSVC exploitation field is poc, but no confirmed exploitation in the wild appears in the sources consulted.

Is there a fix for this vulnerability?

The record lists no fixed version. Check the vendor for firmware updates and, until one is available, restrict access to the web management interface.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.