CVE-2026-9456: Totolink A8000RU OS Command Injection in Web Management Interface
CVE-2026-9456 is a critical OS command injection flaw (CWE-77) in the Web Management Interface of the Totolink A8000RU, reachable remotely through the setOpenVpnCfg function. The CNA, VulDB, scores it 9.8 under CVSS 3.1 and states that a public exploit exists. CISA KEV does not list it, so no confirmed exploitation in the wild appears in the sources consulted.
Overview
CVE-2026-9456 is an OS command injection weakness (CWE-77) in the Web Management Interface of the Totolink A8000RU. The description names firmware version 7.1cu.643_b20200521 and places the flaw in the setOpenVpnCfg function reached through /cgi-bin/cstecgi.cgi. The record was published on 2026-05-25 with VulDB as the CNA.
Impact
The CNA assigns a base score of 9.8 (critical) under CVSS 3.1, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This describes network exploitation without privileges or user interaction, with high impact on confidentiality, integrity and availability. The same CNA also provides 8.9 under CVSS 4.0 and 10 under CVSS 2.0.
The record does not describe the specific consequences of a successful injection. Inferred from the weakness class, an attacker able to reach the interface could likely run commands on the device, but this is not confirmed by the sources.
Affected products and versions
- Product: Totolink A8000RU, version 7.1cu.643_b20200521, as named in the description.
- Component: Web Management Interface, function setOpenVpnCfg, file /cgi-bin/cstecgi.cgi.
- The structured affected list in the record is empty, so the full range of affected versions is unknown.
Exploitation status
The record states that the exploit has been made public and could be used. The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation appears in the sources consulted. The EPSS probability is 0.03253 with a percentile of 0.88052.
Remediation and mitigation
- The record lists no fixed version. This does not mean no fix exists; check the vendor site at https://www.totolink.net/ for firmware updates for the A8000RU.
- Until an update is confirmed, restrict access to the web management interface to trusted administrative networks and disable remote management from untrusted networks.
- Review whether the device exposes its management interface to the internet and remove that exposure if present.
- Replace or isolate devices that cannot be updated and no longer receive vendor support.
Detection guidance
- Review web server logs for requests to /cgi-bin/cstecgi.cgi from unexpected sources, especially requests to the VPN configuration functions.
- Monitor for unexpected changes to VPN settings or device configuration.
- Where device telemetry allows, look for unusual outbound connections or processes originating from the router.
Limitations of the available information
The record provides no fixed version, no affected version range beyond the one named in the description, and no vendor advisory. Its source status is Deferred. A third-party GitHub repository is listed in the references; its content was not analyzed and is not reproduced here.
Frequently asked questions
What is CVE-2026-9456?
It is a critical OS command injection vulnerability (CWE-77) in the Web Management Interface of the Totolink A8000RU, affecting the setOpenVpnCfg function.
Is this vulnerability being actively exploited?
The record says a public exploit exists, but the CVE is not listed in CISA KEV. No confirmed exploitation in the wild appears in the sources consulted.
Is there a fixed version?
The record lists no fixed version. Check the vendor site for firmware updates, and restrict access to the management interface until a fix is confirmed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.