CVE Intelligence
Analysis AI-assisted

CVE-2026-9478: Totolink A8000RU Web Management cstecgi.cgi setParentalRules OS Command Injection

CVE-2026-9478 is an OS command injection weakness (CWE-77) in the setParentalRules function of the Web Management Interface of the Totolink A8000RU, firmware 7.1cu.643_b20200521. VulDB rates it 9.8 (critical) under CVSS 3.1 and reports that the attack can be carried out remotely. The record states that a public exploit exists, but CISA KEV does not list the CVE and no fixed version is recorded in the sources.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-9478 describes an OS command injection weakness, classified as CWE-77, in the setParentalRules function reached through /cgi-bin/cstecgi.cgi on the Web Management Interface of the Totolink A8000RU. The affected firmware is 7.1cu.643_b20200521. The description in the record says the flaw is triggered by manipulating the enable argument and that the attack may be performed remotely. The CVE was published on 2026-05-25 and the CNA is VulDB, with the entry also available at VulDB and in the NVD record.

Impact

  • VulDB scores the vulnerability 9.8 (critical) under CVSS 3.1, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • The vector indicates network attack vector, no privileges and no user interaction, with high confidentiality, integrity and availability impact.
  • Command injection on an embedded router can allow an attacker to run operating system commands on the device, which may affect the network the device protects.
  • The SSVC assessment in the record lists exploitation as proof of concept, automatable as yes and technical impact as total.

Affected products and versions

  • Totolink A8000RU, version 7.1cu.643_b20200521.
  • The sources consulted do not list other affected versions or product revisions.
  • The vendor product page is available at Totolink.

Exploitation status

  • The record states that the exploit has been made available to the public and could be used for attacks.
  • The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog in the record, so no confirmed active exploitation appears in the sources consulted.
  • The FIRST EPSS probability in the record is 0.03253 with a percentile of 0.88058.

Remediation and mitigation

  • No fixed version is recorded in the sources consulted. The absence of a listed fix does not confirm that none exists, so check the vendor site for firmware updates for the A8000RU.
  • If no fix is available, consider replacing the device or retiring it from service, since the model may no longer receive security updates.
  • Do not expose the web management interface to the internet. Disable remote management and restrict administrative access to trusted internal hosts or a management VLAN.
  • Place the device behind network segmentation so that a compromised router cannot reach sensitive internal systems.
  • Change default administrative credentials and review user accounts on the device.

Detection guidance

  • Review web management interface logs for unexpected requests to /cgi-bin/cstecgi.cgi, especially requests to parental control functions from unknown sources.
  • Monitor parental control and other configuration changes on the device and compare them against a known-good baseline.
  • Watch for unexpected outbound connections or traffic patterns originating from the router.
  • Where the device supports it, check for unexpected processes, files or configuration changes after suspicious activity.

Limitations of the available information

  • The sources do not provide a fixed firmware version or vendor advisory text.
  • The record does not describe which specific input validation step is missing, and this analysis does not attempt to reproduce the issue.
  • The EPSS date in the record (2026-10-13) is later than the publication date, so the score should be re-checked against current data.
  • It is unknown how many devices remain exposed on the internet.

Frequently asked questions

Is CVE-2026-9478 being actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, so no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been made available.

Which devices are affected?

The record lists the Totolink A8000RU with firmware version 7.1cu.643_b20200521. No other versions are listed in the sources consulted.

Is there a fix?

No fixed version is recorded in the sources consulted. Check the vendor site for updates and, if none exist, consider replacing or retiring the device.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.