CVE-2026-9388
Published: 24 May 2026
Summary
CVE-2026-9388 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A weakness has been identified in the Totolink A8000RU router running firmware 7.1cu.643_b20200521. The issue resides in the setScheduleCfg function within the /cgi-bin/cstecgi.cgi file of the Web Management Interface component. Manipulation of the mode argument allows an attacker to perform OS command injection, as classified under CWE-77 and CWE-78. The vulnerability is remotely exploitable and carries a CVSS 4.0 score of 8.9.
An unauthenticated remote attacker can supply a crafted mode parameter to the web interface and execute arbitrary operating system commands on the device. Successful exploitation grants the attacker the ability to read, modify, or delete data and fully compromise the router's confidentiality, integrity, and availability. A public exploit has already been released.
The EPSS score remains flat at 0.0125 with no material increase since disclosure. Reference materials include a detailed proof-of-concept on GitHub, multiple Vuldb entries, and the vendor's site, though no specific patch or mitigation guidance is provided in the available sources.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-31544
Vulnerability details
A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument mode can lead to os command injection. It…
more
is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote OS command injection in web management interface directly enables exploitation of public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the mode argument supplied to setScheduleCfg, blocking the OS command injection vector in /cgi-bin/cstecgi.cgi.
Enforces authentication and authorization checks before allowing any access to the Web Management Interface functions, preventing the unauthenticated remote exploitation described.
Restricts remote access methods and requires additional controls (e.g., VPN, allow-lists) for the management interface, reducing the attack surface for the publicly exploitable command injection.