CVE-2026-9406
Published: 25 May 2026
Summary
CVE-2026-9406 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-17 (Remote Access).
Deeper analysis
A weakness has been identified in the Totolink A8000RU firmware version 7.1cu.643_b20200521. The issue resides in the setRemoteCfg function within the /cgi-bin/cstecgi.cgi file of the Web Management Interface and stems from improper handling of the enable argument, resulting in operating system command injection. The flaw is tracked under CVE-2026-9406 with CVSS 4.0 score 8.9 and is also associated with CWE-77 and CWE-78.
The vulnerability can be exploited remotely by an unauthenticated attacker who sends a crafted HTTP request to the web interface, allowing arbitrary operating system commands to be executed on the device. Public exploit code has been released, enabling attackers to achieve full control over the affected router.
The EPSS score remains flat at 0.0125 with no material increase after disclosure. Available references include a public proof-of-concept repository and vendor contact information but do not detail any official patches or mitigation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-31606
Vulnerability details
A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setRemoteCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack can…
more
be executed remotely. The exploit has been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in web management interface directly enables remote exploitation of public-facing app (T1190) and Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of the 'enable' argument in setRemoteCfg before it reaches the OS command interpreter, blocking the injection vector.
Restricts or requires explicit authorization for remote HTTP access to the web management interface, eliminating the unauthenticated attack path.
Applies boundary filtering to block external traffic to /cgi-bin/cstecgi.cgi, preventing remote exploitation of the command-injection flaw.