CVE-2026-9457: Totolink A8000RU Command Injection in Web Management Interface
CVE-2026-9457 is an OS command injection flaw in the Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521, reached through the UploadFirmwareFile function of /cgi-bin/cstecgi.cgi. The CNA VulDB rates it critical with CVSS 3.1 9.8 and describes remote exploitation with a publicly disclosed exploit. The record lists no fixed version or affected range, and the CVE is not in CISA KEV.
Overview
CVE-2026-9457 affects the Web Management Interface of the Totolink A8000RU, specifically the UploadFirmwareFile function reached through /cgi-bin/cstecgi.cgi. The weakness is classified as CWE-77 (Command Injection) and is described as allowing OS command injection through the FileName argument. Details are taken from the VulDB entry.
Impact
The CNA reports CVSS 3.1 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates a network attack vector, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability.
Inference: successful command injection on this device would likely give an attacker control over its operating system, which is consistent with the critical rating.
Affected products and versions
- Product: Totolink A8000RU
- Version named in the record: 7.1cu.643_b20200521
- Component: Web Management Interface
The record's affected list is empty, so other versions cannot be confirmed from the available sources.
Exploitation status
The record states that the exploit has been publicly disclosed and may be used. The CVE is not listed in CISA KEV, so no confirmed active exploitation in the wild appears in the sources consulted. The EPSS probability is 0.03253 (percentile 0.88051) as of the record date, which is a statistical estimate and not confirmation of exploitation.
Remediation and mitigation
- Check the Totolink website for a firmware update addressing this issue. The record lists no fixed version, so the availability of a fix is unknown.
- Until a fix is verified, restrict access to the web management interface to trusted administrative networks and do not expose it to the internet.
- Disable remote management where the product allows it.
- If no supported fix exists, plan replacement or isolation of the device, since an unpatched device with a publicly disclosed exploit is a high-risk asset.
Detection guidance
- Review web server logs for requests to /cgi-bin/cstecgi.cgi, especially upload-related requests, from unexpected sources.
- Monitor the device for unexpected outbound connections or new processes where logging is available.
- Treat unexplained firmware upload events or configuration changes as possible compromise indicators.
Limitations of the available information
The record gives no fixed version, no affected range beyond one firmware string, no vendor advisory text, and no authentication details beyond the CVSS vector. Whether the upload function is reachable on every deployment is not confirmed. The CVSS 4.0 (8.9) and CVSS 2.0 (10) scores come from the same CNA and do not change this analysis.
Frequently asked questions
Is CVE-2026-9457 being actively exploited?
The CVE is not listed in CISA KEV, so no confirmed active exploitation in the wild appears in the sources consulted. The record does state that a publicly disclosed exploit exists, which makes prompt mitigation important.
What is the first step for administrators?
Restrict access to the device web management interface to trusted networks, disable remote management where possible, and check the vendor site for a verified firmware update.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.