CVE Intelligence
Analysis AI-assisted

CVE-2026-9455: Totolink A8000RU OS Command Injection in UploadOpenVpnCert

CVE-2026-9455 is an OS command injection flaw in the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521. The record states that manipulating the FileName argument in the UploadOpenVpnCert function of /cgi-bin/cstecgi.cgi can lead to command execution and that remote exploitation is possible. The CNA rates it critical with a CVSS 3.1 base score of 9.8, and the record notes that exploit information has been publicly disclosed, but CISA KEV does not list it.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-9455 describes an OS command injection weakness (CWE-77) in the Web Management Interface of the Totolink A8000RU, firmware version 7.1cu.643_b20200521. The flaw is located in the UploadOpenVpnCert function of the /cgi-bin/cstecgi.cgi component, where the FileName argument is handled in a way that allows operating system commands to be injected. The record was published by VulDB as a CNA.

Impact

  • The CNA rates the CVSS 3.1 base score at 9.8 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • The record states that remote exploitation is possible.
  • The SSVC data in the record lists technical impact as total and automatable as yes.
  • A CVSS 4.0 score of 9.3 from VulDB also appears in the record, alongside an 8.9 from the CNA.

Affected products and versions

  • Totolink A8000RU, version 7.1cu.643_b20200521 (the only version listed in the record).
  • The record does not list other affected versions, and it lists no fixed versions. Whether other firmware branches are affected is unknown from the sources consulted.

Exploitation status

  • The record states that an exploit has been publicly disclosed and may be used.
  • The SSVC exploitation field is recorded as poc (proof of concept).
  • The CISA KEV catalog does not list this CVE. No confirmed active exploitation or exploitation in the wild appears in the sources consulted.
  • The EPSS probability is 0.03253 with a percentile of 0.88052, as recorded.

Remediation and mitigation

  • No fixed version is listed in the record. The absence of a listed fix does not mean none exists, so check the vendor site at Totolink for firmware updates or advisories for this model.
  • Until a verified update is applied, restrict access to the web management interface. Do not expose it to the internet, limit it to trusted administrative networks, and disable remote management where it is not needed.
  • Segment devices that run this firmware from sensitive internal systems and review whether the device should remain in service.
  • Consider replacing unsupported or unpatched devices if the vendor does not provide a fix.

Detection guidance

  • Review web server and device logs for unexpected requests to /cgi-bin/cstecgi.cgi, especially from unknown or external sources.
  • Monitor the device for unexpected configuration changes, new files, or processes that were not created by administrators.
  • Alert on unusual outbound connections originating from the router or access device.

Limitations of the available information

  • The record lists no fixed version and no vendor advisory.
  • The record does not include details of the vulnerable code, exact preconditions, or the scope of affected hardware beyond the listed model and firmware version.
  • The EPSS entry carries a date (2026-10-13) that is later than the publication date, so its timing should be treated with caution.
  • Analysis is limited to the data in the CVE record and the sources it references.

Frequently asked questions

Is CVE-2026-9455 known to be actively exploited?

CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been disclosed.

Which Totolink A8000RU version is affected?

The record lists firmware version 7.1cu.643_b20200521 as the affected version. It does not list other versions or any fixed version.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.