PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9458 Totolink CVE debrief

A remote OS command injection vulnerability exists in Totolink A8000RU firmware version 7.1cu.643_b20200521. The vulnerability resides in the `setWanCfg` function within the `/cgi-bin/cstecgi.cgi` endpoint of the web management interface. The `enabled` parameter is susceptible to command injection, allowing unauthenticated remote attackers to execute arbitrary operating system commands. The CVSS 4.0 score of 8.9 (HIGH) reflects network attack vector, low attack complexity, no required privileges, and high impact to confidentiality, integrity, and availability. The vulnerability was published on 2026-05-25 and modified on 2026-05-26. Public exploit availability is indicated in the CVSS vector (E:P). The vendor attribution is based on reference domain analysis with low confidence and requires review.

Vendor
Totolink
Product
A8000RU
CVSS
HIGH 8.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-07-23
Advisory published
2026-05-25
Advisory updated
2026-07-23

Who should care

Organizations deploying Totolink A8000RU routers in production environments, particularly those with exposed web management interfaces. Security teams responsible for IoT and network infrastructure protection. Managed service providers maintaining customer premise equipment.

Technical summary

The vulnerability exists in the `setWanCfg` function of `/cgi-bin/cstecgi.cgi` on Totolink A8000RU devices running firmware 7.1cu.643_b20200521. Insufficient input validation on the `enabled` parameter allows injection of operating system commands. The attack can be performed remotely without authentication. The CVSS 4.0 score of 8.9 indicates HIGH severity with network attack vector, low complexity, and high impacts across confidentiality, integrity, and availability. The exploit is publicly available per the CVSS E:P metric.

Defensive priority

HIGH

Recommended defensive actions

  • Restrict network access to the web management interface of affected Totolink A8000RU devices; implement firewall rules to block external access to /cgi-bin/cstecgi.cgi
  • Monitor for suspicious requests to the /cgi-bin/cstecgi.cgi endpoint containing the setWanCfg action, particularly those with anomalous 'enabled' parameter values
  • Apply firmware updates from Totolink when available; verify vendor security advisories at the official Totolink website
  • Consider disabling remote web management access if not required for operational purposes
  • Review device logs for indicators of compromise, including unexpected command execution or configuration changes

Evidence notes

Vulnerability identified in Totolink A8000RU 7.1cu.643_b20200521. Affected function: setWanCfg in /cgi-bin/cstecgi.cgi. Attack vector: manipulation of 'enabled' argument leading to OS command injection. CWE-77 and CWE-78 classified. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P. Exploit marked as publicly available per CVSS E:P metric. Vendor attribution derived from reference domain candidate (Vuldb) with low confidence; needs review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9458 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9458

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9458 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9458

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.