CVE Intelligence
Analysis AI-assisted

CVE-2026-9475: Totolink A8000RU Command Injection in setIpQosRules

CVE-2026-9475 is a command injection weakness (CWE-77) reported in the Web Management Interface of the Totolink A8000RU, firmware 7.1cu.643_b20200521. The record describes the flaw in the setIpQosRules function reached through /cgi-bin/cstecgi.cgi and states that the exploit has been publicly disclosed. The record shows no KEV listing and no confirmed active exploitation, and it provides no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-9475 is a command injection weakness (CWE-77) reported in the Web Management Interface of the Totolink A8000RU, firmware 7.1cu.643_b20200521. According to the record, the flaw is in the setIpQosRules function reached through /cgi-bin/cstecgi.cgi, where the Comment argument allows operating system command injection.

Impact

The CNA scoring in the record is CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This describes network exploitation without privileges or user interaction, with high impact on confidentiality, integrity and availability. The same CNA also reports CVSS 4.0 8.9. The record does not describe the consequences in any specific deployment.

Affected products and versions

  • Product: Totolink A8000RU
  • Version reported: 7.1cu.643_b20200521
  • The record's affected list is empty, so other versions can neither be confirmed nor excluded from the available data.

Exploitation status

The record states that the exploit has been publicly disclosed and may be utilized. The CISA KEV catalog has no entry for this CVE (listed: false), so this record does not confirm exploitation in the wild. No confirmed active exploitation appears in the sources consulted.

Remediation and mitigation

The record contains no fixed version and no vendor patch reference. Until the vendor or other reliable sources confirm a fix, organizations running this device should:

  • Check the vendor site at totolink.net for firmware updates and advisories.
  • Remove management interface exposure from the internet and restrict administrative access to trusted networks.
  • Treat the device as at risk if it runs the reported version and cannot be updated, and consider isolating or replacing it.
  • Review device configuration for unexpected QoS rules or altered comment fields.

Detection guidance

  • Review web management logs for requests to the cstecgi.cgi endpoint from unexpected sources or with unusual parameter content.
  • Monitor the device for unexpected outbound connections or newly started processes, where the platform allows it.
  • Correlate changes to QoS rule configuration with administrative activity.

Limitations of the available information

The sources do not provide vendor advisory text, affected version ranges, fixed versions, a patch, or independent technical validation. The EPSS probability of 0.03253 (percentile 0.88057) is a model estimate of exploitation likelihood, not evidence of exploitation. The record's source status is Deferred.

Frequently asked questions

Is CVE-2026-9475 being actively exploited?

The record says a public exploit has been disclosed, but the CISA KEV catalog has no entry for this CVE. No confirmed active exploitation appears in the sources consulted.

Which Totolink versions are affected?

The record reports firmware 7.1cu.643_b20200521 for the Totolink A8000RU, but its affected list is empty. Other versions cannot be confirmed or excluded from the available data.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.