Cyber Resilience

CVE-2026-9388

HighRCE

Published: 24 May 2026

Published
24 May 2026
Modified
26 May 2026
KEV Added
Patch
CVSS Score v4 8.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0209 79.3th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-9388 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

A weakness has been identified in the Totolink A8000RU router running firmware 7.1cu.643_b20200521. The issue resides in the setScheduleCfg function within the /cgi-bin/cstecgi.cgi file of the Web Management Interface component. Manipulation of the mode argument allows an attacker to perform OS command injection, as classified under CWE-77 and CWE-78. The vulnerability is remotely exploitable and carries a CVSS 4.0 score of 8.9.

An unauthenticated remote attacker can supply a crafted mode parameter to the web interface and execute arbitrary operating system commands on the device. Successful exploitation grants the attacker the ability to read, modify, or delete data and fully compromise the router's confidentiality, integrity, and availability. A public exploit has already been released.

The EPSS score remains flat at 0.0125 with no material increase since disclosure. Reference materials include a detailed proof-of-concept on GitHub, multiple Vuldb entries, and the vendor's site, though no specific patch or mitigation guidance is provided in the available sources.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument mode can lead to os command injection. It…

more

is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Remote OS command injection in web management interface directly enables exploitation of public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-9434Shared CWE-77, CWE-78
CVE-2026-7240Shared CWE-77, CWE-78
CVE-2026-9407Shared CWE-77, CWE-78
CVE-2026-9436Shared CWE-77, CWE-78
CVE-2025-9727Shared CWE-77, CWE-78
CVE-2026-9478Shared CWE-77, CWE-78
CVE-2026-9475Shared CWE-77, CWE-78
CVE-2026-7204Shared CWE-77, CWE-78
CVE-2026-2152Shared CWE-77, CWE-78
CVE-2026-5677Shared CWE-77, CWE-78

Affected Assets

Totolink
A8000RU
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of the mode argument supplied to setScheduleCfg, blocking the OS command injection vector in /cgi-bin/cstecgi.cgi.

prevent

Enforces authentication and authorization checks before allowing any access to the Web Management Interface functions, preventing the unauthenticated remote exploitation described.

AC-17 Remote Access partial match
prevent

Restricts remote access methods and requires additional controls (e.g., VPN, allow-lists) for the management interface, reducing the attack surface for the publicly exploitable command injection.

References