CVE-2026-9454: Totolink A8000RU OS Command Injection via setOpenVpnCertGenerationCfg
A command injection flaw (CWE-77) has been reported in the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521. According to the CNA record, manipulating the servername argument of setOpenVpnCertGenerationCfg in /cgi-bin/cstecgi.cgi may allow remote OS command injection, and the record notes that a published exploit may be used. The CNA rates it 9.8 under CVSS 3.1, and the record shows it is not listed in CISA KEV.
Overview
The CNA record (VulDB) describes an OS command injection issue classified as CWE-77 in the setOpenVpnCertGenerationCfg function of /cgi-bin/cstecgi.cgi, which is part of the Web Management Interface of the Totolink A8000RU firmware 7.1cu.643_b20200521. Further details are summarized in the VulDB entry and the NVD record.
Impact
- The CNA CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack, low complexity, no privileges and no user interaction required, with high impact to confidentiality, integrity and availability.
- Command injection generally allows commands to run on the underlying operating system. The privilege level under which such commands would run is unknown from the record.
- The CNA also lists CVSS 4.0 at 8.9 and CVSS 2.0 at 10.
Affected products and versions
- The record identifies firmware 7.1cu.643_b20200521 of the Totolink A8000RU.
- The structured data contains no affected version range and no fixed version. Do not assume that other versions or builds are either affected or unaffected.
Exploitation status
- The record states that the exploit has been published and may be used. This analysis does not reproduce any exploit details.
- The record shows this CVE is not listed in CISA KEV. No confirmed active exploitation appears in the sources consulted.
- The EPSS entry in the record gives a probability of 0.03253 and a percentile of 0.88053.
Remediation and mitigation
- The record does not contain vendor fix information. Check the Totolink website for firmware updates and advisories, and confirm any update against the vendor's own documentation.
- Do not expose the web management interface to the internet. Restrict it to trusted management networks and disable remote administration if it is not needed.
- Inventory all A8000RU devices and identify any running the listed firmware build.
- If no vendor fix is available, consider isolating the device, replacing it, or placing it behind controls that limit access to its management interface.
Detection guidance
- Review web server and device logs for unexpected requests to /cgi-bin/cstecgi.cgi, especially those related to VPN certificate configuration.
- Monitor the device for unexpected outbound connections, new administrative accounts, or unplanned configuration changes.
Limitations of the available information
- The analysis relies on a single CNA record and a short reference list. The GitHub repository listed in the references was not evaluated for content.
- No vendor advisory was confirmed, and no affected range or fixed version is provided.
- The source status is recorded as Deferred, so the information may change.
Frequently asked questions
What is the vulnerability in CVE-2026-9454?
The CNA record describes an OS command injection (CWE-77) in the setOpenVpnCertGenerationCfg function of /cgi-bin/cstecgi.cgi on the Totolink A8000RU, triggered by manipulating the servername argument.
Is this CVE being actively exploited?
The record is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record does state that a published exploit may be used.
What should administrators do now?
Check the vendor for firmware updates, restrict access to the management interface to trusted networks, disable remote administration if unused, and inventory affected devices. The record does not provide a fixed version.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.