CVE-2026-9387: OS Command Injection in Totolink A8000RU
A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument resetFlags results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
AI Analysis
Technical Summary
This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. The issue is an OS command injection in the setUpgradeFW function of the /cgi-bin/cstecgi.cgi Web Management Interface. By manipulating the resetFlags argument, an unauthenticated remote attacker can execute arbitrary operating system commands on the device. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 9.3, reflecting its critical impact. No official patch or mitigation has been disclosed by Totolink, and the device is not a cloud service, so remediation depends on vendor action or user intervention.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected Totolink A8000RU device without authentication. This can lead to full compromise of the device, including unauthorized control, data theft, or disruption of network services. The critical CVSS score (9.3) reflects the high potential impact. No confirmed exploitation in the wild has been reported yet.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the Web Management Interface from untrusted networks to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.
CVE-2026-9387: OS Command Injection in Totolink A8000RU
Description
A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument resetFlags results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
CVSS v4.0
Score 9.3critical
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. The issue is an OS command injection in the setUpgradeFW function of the /cgi-bin/cstecgi.cgi Web Management Interface. By manipulating the resetFlags argument, an unauthenticated remote attacker can execute arbitrary operating system commands on the device. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 9.3, reflecting its critical impact. No official patch or mitigation has been disclosed by Totolink, and the device is not a cloud service, so remediation depends on vendor action or user intervention.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected Totolink A8000RU device without authentication. This can lead to full compromise of the device, including unauthorized control, data theft, or disruption of network services. The critical CVSS score (9.3) reflects the high potential impact. No confirmed exploitation in the wild has been reported yet.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the Web Management Interface from untrusted networks to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-23T15:03:13.975Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a130bc909f6977edb6e608a
Added to database: 05/24/2026, 14:31:37 UTC
Last enriched: 05/31/2026, 20:36:30 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 93
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.