CVE-2026-9477: Totolink A8000RU Command Injection via cstecgi.cgi setAccessDeviceCfg
A command injection flaw (CWE-77) has been reported in the setAccessDeviceCfg function of the Totolink A8000RU web management interface, through the mac argument. VulDB assigns a CVSS 3.1 base score of 9.8, and the record describes remote attack and a publicly released exploit. No fixed version is listed in the sources consulted, and this CVE is not in the CISA KEV catalog.
Overview
CVE-2026-9477 describes an OS command injection flaw in the setAccessDeviceCfg function of the /cgi-bin/cstecgi.cgi handler in the web management interface of the Totolink A8000RU, version 7.1cu.643_b20200521. According to the record, manipulating the mac argument can cause attacker-supplied text to be passed to the operating system. The CWE classification is CWE-77 (Command Injection). Details are published by VulDB and the NVD entry.
Impact
The CVSS 3.1 vector in the record is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a network-reachable flaw requiring no privileges or user interaction, with high impact on confidentiality, integrity and availability. The record also lists CVSS 4.0 scores of 9.3 (VulDB) and 8.9 (cna@vuldb.com). An SSVC assessment in the record rates technical impact as total and automatable as yes.
Affected products and versions
- Totolink A8000RU, version 7.1cu.643_b20200521 (the only version listed in the record).
- The affected component is the Web Management Interface, function setAccessDeviceCfg.
The record does not list other affected versions. Whether earlier or later firmware builds are affected is unknown from the available data.
Exploitation status
The record states that the exploit has been released to the public and may be used for attacks. A public exploit reference is listed among the sources. The CISA KEV listing is false, so no confirmed active exploitation is reported in the sources consulted. The EPSS probability in the record is 0.03253 (percentile 0.88058). The SSVC exploitation field is poc, which means proof-of-concept availability.
Remediation and mitigation
- No fixed version is listed in the record. Check the vendor site and the VulDB entry for updates, and treat the absence of a listed fix as unknown rather than as confirmed absence.
- Until a verified fix is applied, restrict access to the device management interface to trusted administrative networks and disable remote management from untrusted networks.
- Place affected devices behind segmentation controls so that the web interface is not exposed to the internet.
- Replace or retire devices that the vendor no longer supports.
Detection guidance
- Review web server and device logs for unexpected requests to /cgi-bin/cstecgi.cgi, especially requests to the setAccessDeviceCfg function with unusual values in the mac parameter.
- Monitor for unexpected configuration changes, new processes or outbound connections originating from the device.
- Forward device logs to a central system so that suspicious activity can be investigated.
Limitations of the available information
The record provides no fixed version, no vendor advisory and no confirmed list of other affected firmware builds. The EPSS date in the record (2026-10-13) is later than the publication date, so the timing of that score should be verified. The sources consulted do not report confirmed exploitation in the wild.
Frequently asked questions
Is CVE-2026-9477 being actively exploited?
The record states that a public exploit has been released, but the CISA KEV listing is false. No confirmed active exploitation appears in the sources consulted.
Is there a fixed version for the Totolink A8000RU flaw?
No fixed version is listed in the record. The absence of a listed fix is unknown, so check the vendor and VulDB pages for updates.
What is the main risk of this vulnerability?
The CVSS 3.1 vector describes remote, unauthenticated command injection with high impact on confidentiality, integrity and availability, which is why the score is 9.8.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.