CVE-2026-9477 is a critical OS command injection vulnerability in the Totolink A8000RU router firmware version 7.1cu.643_b20200521. The flaw exists in the setAccessDeviceCfg function of the /cgi-bin/cstecgi.cgi web management interface component. An attacker can remotely manipulate the mac argument to execute arbitrary OS commands. The vulnerability has a high CVSS 4.0 score of 9.3, indicating critical severity. Although an exploit has been publicly released, there are no confirmed reports of exploitation in the wild.
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument admpass leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used.
CVE-2026-9475 is a critical OS command injection vulnerability in the Totolink A8000RU router firmware version 7.1cu.643_b20200521. The flaw exists in the setIpQosRules function within the /cgi-bin/cstecgi.cgi Web Management Interface component. An attacker can remotely exploit this vulnerability by manipulating the Comment argument, leading to arbitrary OS command execution. The vulnerability has a high CVSS score of 9.3 and has been publicly disclosed, though no known exploits in the wild have been reported. No official patch or remediation guidance is currently available from the vendor.
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument enabled leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVE-2026-9457 is a critical OS command injection vulnerability in the Totolink A8000RU router firmware version 7.1cu.643_b20200521. The flaw exists in the UploadFirmwareFile function within the /cgi-bin/cstecgi.cgi component of the web management interface. An attacker can remotely manipulate the FileName argument to execute arbitrary OS commands. The vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact if exploited. Although the exploit code has been publicly disclosed, there is no confirmed evidence of exploitation in the wild.
CVE-2026-9456 is a critical OS command injection vulnerability in the Totolink A8000RU router's web management interface. It affects version 7.1cu.643_b20200521, specifically the setOpenVpnCfg function in /cgi-bin/cstecgi.cgi. The vulnerability allows remote attackers to manipulate input arguments to execute arbitrary OS commands. The exploit code has been publicly disclosed, increasing the risk of exploitation. No official patch or remediation guidance is currently available from the vendor. The vulnerability has a CVSS 4.0 base score of 9.
CVE-2026-9455 is a critical OS command injection vulnerability in the Totolink A8000RU router firmware version 7.1cu.643_b20200521. The flaw exists in the UploadOpenVpnCert function of the /cgi-bin/cstecgi.cgi web management interface component. An attacker can remotely exploit this vulnerability by manipulating the FileName argument, leading to arbitrary OS command execution. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor. The CVSS 4.0 base score is 9.3, indicating a high severity with network attack vector and no required privileges or user interaction.
A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setOpenVpnCertGenerationCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument servername can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used.
A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used.
CVE-2026-9435 is a critical OS command injection vulnerability in the Totolink A8000RU router firmware version 7.1cu.643_b20200521. The flaw exists in the setQosCfg function of the /cgi-bin/cstecgi.cgi web management interface component. An attacker can remotely manipulate the 'enable' argument to execute arbitrary OS commands without authentication. The vulnerability has a high CVSS 4.0 score of 9.3, indicating critical severity. Exploit code is publicly available, increasing the risk of exploitation.
A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setWiFiWpsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument wscDisabled leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-9433 is a critical OS command injection vulnerability in the Totolink A8000RU router, version 7.1cu.643_b20200521. The vulnerability exists in the setMacFilterRules function of the /cgi-bin/cstecgi.cgi file within the Web Management Interface. An attacker can remotely manipulate the 'enable' argument to execute arbitrary OS commands. The exploit code is publicly available, increasing the risk of exploitation. No official patch or remediation guidance has been provided yet.
CVE-2026-9432 is a critical OS command injection vulnerability in the Totolink A8000RU router firmware version 7.1cu.643_b20200521. It affects the setWiFiAdvancedCfg function within the /cgi-bin/cstecgi.cgi web management interface. An attacker can remotely exploit this flaw by manipulating the bgProtection argument, leading to arbitrary OS command execution. The vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact. Although the exploit code has been publicly released, there is no official patch or remediation guidance available from the vendor at this time.
CVE-2026-9408 is a critical OS command injection vulnerability in the Totolink A8000RU router's web management interface, specifically in the setStaticDhcpRules function of /cgi-bin/cstecgi.cgi. The vulnerability allows remote attackers to manipulate the 'enable' argument to execute arbitrary OS commands. The affected version is 7.1cu.643_b20200521. Exploit code is publicly available, but no official patch or remediation guidance has been provided yet.
CVE-2026-9407 is a critical OS command injection vulnerability in the Totolink A8000RU router firmware version 7.1cu.643_b20200521. The flaw exists in the setFirewallType function of the /cgi-bin/cstecgi.cgi file within the Web Management Interface. An attacker can remotely manipulate the firewallType argument to execute arbitrary OS commands. The vulnerability has been publicly disclosed and carries a high risk due to its remote, unauthenticated nature and potential for full system compromise. No official patch or remediation guidance is currently available from the vendor. Exploits are not yet observed in the wild, but the public disclosure increases the risk of exploitation attempts.
A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setRemoteCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-9405 is a critical OS command injection vulnerability in the Totolink A8000RU router firmware version 7.1cu.643_b20200521. The flaw exists in the setGameSpeedCfg function of the /cgi-bin/cstecgi.cgi web management interface component. An attacker can remotely manipulate the 'enable' argument to execute arbitrary OS commands without authentication or user interaction. The vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact. Although an exploit has been publicly released, there is no confirmed patch or official remediation available at this time.
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument provider leads to os command injection. The attack may be launched remotely. The exploit is publicly available and might be used.
A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument mode can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument resetFlags results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.