CVE-2026-9458: Totolink A8000RU Web Management cstecgi.cgi setWanCfg OS Command Injection

Overview

CVE-2026-9458 affects the Web Management Interface of the Totolink A8000RU router, specifically the setWanCfg function exposed through /cgi-bin/cstecgi.cgi. According to the VulDB record, manipulation of an argument handled by this function leads to OS command injection (CWE-77). The record was published on 2026-05-25 by VulDB and is marked with source status Deferred.

Impact

According to the CNA scoring, the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates network attack vector, low complexity, no privileges and no user interaction required, with high impact on confidentiality, integrity and availability. The base score is 9.8. Because command injection on a network device can grant control over the device, the practical consequence in a successful case would be full compromise of the device, which is an inference from the vector and CWE rather than a statement in the sources.

Affected products and versions

• Product: Totolink A8000RU
• Version listed in the record: 7.1cu.643_b20200521

The record does not list other affected versions. Whether earlier or later firmware builds are affected is unknown from the sources consulted.

Exploitation status

The VulDB description states that the exploit is publicly available and might be used. The SSVC data in the record marks exploitation as proof of concept and automatable as yes. CISA KEV does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

The record contains no fixed version and no vendor patch reference, so the fix status is unknown. Defenders should check the Totolink product page for firmware updates and confirm with the vendor whether a fixed build exists for this model. Until a fix is verified, administrators should restrict access to the web management interface, avoid exposing it to the internet, place it behind network segmentation or a VPN, and disable remote management where possible.

Detection guidance

• Review device logs and web server access logs for unexpected requests to /cgi-bin/cstecgi.cgi, especially from unknown sources.
• Monitor for unexpected configuration changes on WAN settings and for device reboots or outbound connections originating from the router.
• Compare device firmware version against the affected build and inventory all A8000RU units in the environment.

Limitations of the available information

The sources consulted provide a short technical description, a CVSS record from VulDB and the CNA, and an SSVC assessment. They do not provide a vendor advisory, a fixed version, detailed affected version ranges or confirmed in-the-wild exploitation data. The CNA record is marked Deferred in the source status, so its details may change. Further verification with the vendor and the cited references is recommended.

References: NVD entry, CVE Record, VulDB entry.

Frequently asked questions

What is CVE-2026-9458?

It is an OS command injection vulnerability in the setWanCfg function of the Web Management Interface of the Totolink A8000RU, firmware 7.1cu.643_b20200521, according to the VulDB record.

Can it be exploited remotely?

The record states that the attack may be performed remotely, and the CVSS 3.1 vector lists network attack vector with no privileges and no user interaction required.

Is this vulnerability in the CISA KEV catalog?

No. The KEV data in the record shows it is not listed, and no confirmed exploitation in the wild appears in the sources consulted.

Is there a fixed version?

The record lists no fixed version, so fix status is unknown. Check the vendor for firmware updates and restrict access to the management interface in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.