CVE-2026-9386
Published: 24 May 2026
Summary
CVE-2026-9386 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-17 (Remote Access).
Deeper analysis
A vulnerability identified as CVE-2026-9386 affects the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. It resides in the setLanguageCfg function within the /cgi-bin/cstecgi.cgi file of the web management interface, where improper handling of the lang argument enables OS command injection, corresponding to CWE-77 and CWE-78. The issue carries a CVSS 4.0 score of 8.9, reflecting network-accessible exploitation without authentication or user interaction.
Remote attackers can supply crafted input to the lang parameter and execute arbitrary operating system commands on the device, resulting in full compromise of confidentiality, integrity, and availability. The attack requires no privileges and can be launched over the network against exposed management interfaces.
Public references include a detailed proof-of-concept on GitHub along with Vuldb entries, while the vendor site at totolink.net is listed without accompanying patch or mitigation guidance in the available data. The exploit code has been published, yet the EPSS score remains flat at 0.0125 with no observed increase since disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-31546
Vulnerability details
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument lang leads to os command injection. The attack may be performed from…
more
remote. The exploit is publicly available and might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote command injection in web management interface directly enables T1190 (public app exploitation) and arbitrary Unix shell command execution via T1059.004.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the lang argument in setLanguageCfg to block OS command injection via cstecgi.cgi.
Enforces boundary protection rules that can deny unauthenticated network access to the web management interface exposing the vulnerable function.
Restricts remote management connections to the router, reducing the attack surface for the publicly documented exploit against the lang parameter.