The vulnerability CVE-2026-9457 exists in the Totolink A8000RU router firmware 7.1cu.643_b20200521. It is an OS command injection flaw in the UploadFirmwareFile function of the /cgi-bin/cstecgi.cgi web management interface component. By manipulating the FileName parameter, an unauthenticated remote attacker can execute arbitrary OS commands on the device. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The exploit code has been publicly disclosed, but no official patch or vendor advisory is currently available.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication. This can lead to full compromise of the router, including unauthorized access, control over network traffic, and potential disruption of network services. The vulnerability impacts confidentiality, integrity, and availability of the device and connected networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the router's web management interface from untrusted networks and monitor for suspicious activity. Avoid exposing the device management interface to the internet. Follow vendor communications for updates on patches or mitigations.