PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9434 Totolink CVE debrief

A command injection vulnerability exists in the Totolink A8000RU wireless router firmware version 7.1cu.643_b20200521. The vulnerability resides in the `setWiFiWpsCfg` function within the `/cgi-bin/cstecgi.cgi` web management interface endpoint. The `wscDisabled` parameter is not properly sanitized before being passed to system shell execution, allowing remote attackers to inject arbitrary operating system commands. The attack vector is network-accessible without authentication requirements. Public exploit disclosure has been confirmed, increasing the likelihood of active exploitation. The vulnerability is classified as HIGH severity with a CVSS 4.0 score of 8.9.

Vendor
Totolink
Product
A8000RU
CVSS
HIGH 8.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-05-26
Advisory published
2026-05-25
Advisory updated
2026-05-26

Who should care

Network administrators managing Totolink A8000RU deployments; security operations centers monitoring IoT/embedded device threats; incident response teams tracking router exploitation campaigns; vulnerability management programs prioritizing unauthenticated remote code execution flaws

Technical summary

The vulnerability is an OS command injection (CWE-78) in the web management CGI binary of Totolink A8000RU routers. The `setWiFiWpsCfg` function processes the `wscDisabled` parameter without adequate input validation or sanitization, permitting shell metacharacters and command separators to reach system() or equivalent execution contexts. The `/cgi-bin/cstecgi.cgi` endpoint is reachable via HTTP/HTTPS on the LAN and potentially WAN interfaces depending on configuration. Successful exploitation yields arbitrary command execution with the privileges of the web server process, typically root on embedded Linux router firmware. The CVSS 4.0 score of 8.9 reflects network accessibility, low complexity, no authentication barriers, and high impacts across confidentiality, integrity, and availability dimensions.

Defensive priority

HIGH

Recommended defensive actions

  • Restrict network access to the web management interface of affected Totolink A8000RU devices; implement firewall rules to block inbound connections to TCP port 80/443 from untrusted networks
  • Monitor for suspicious HTTP POST requests to /cgi-bin/cstecgi.cgi containing the setWiFiWpsCfg action with anomalous wscDisabled parameter values
  • Apply firmware updates from Totolink when available; verify patch version exceeds 7.1cu.643_b20200521
  • Consider disabling remote web management access entirely if not operationally required
  • Review device logs for indicators of compromise including unexpected command execution or configuration changes

Evidence notes

Vulnerability confirmed through Vuldb CNA submission and NVD record. Affected function and parameter identified in source references. CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity, and availability. CWE-77 and CWE-78 (Command Injection) weaknesses documented.

Official resources

Public exploit disclosed