Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-9435: Totolink A8000RU Web Management Interface Allows Remote Attack

CVE-2026-9435 · published 5 months ago

Summary

The Totolink A8000RU's web management interface has a security flaw that allows hackers to execute unauthorized commands on the device from anywhere. This means an attacker could potentially take control of the device or cause it to malfunction. To protect your device, you should consider updating the software to the latest version or replacing it if a fix is not available.

Original advisory text

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setQosCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument enable results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

References

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

8.9 High

Exploitation

2% chance of attack within 30 days

Type

CWE-77Command Injection

CWE-78OS Command Injection

Timeline

Published25 May 2026

Updated30 Oct 2026

First seen26 May 2026

Sources

CVE-2026-9435 · NVD

Track software like this

Free during beta