CVE-2026-9407
Published: 25 May 2026
Summary
CVE-2026-9407 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A security vulnerability has been detected in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The issue resides in the setFirewallType function within the /cgi-bin/cstecgi.cgi file of the Web Management Interface component, where improper handling of the firewallType argument enables OS command injection. The flaw is tracked under CVE-2026-9407 with a CVSS 4.0 score of 8.9 and is associated with CWE-77 and CWE-78.
Remote attackers can exploit the vulnerability without authentication or user interaction by sending crafted requests to the web interface, allowing them to execute arbitrary operating system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected router.
The exploit has been publicly disclosed, with details available in repositories such as GitHub and VulDB entries, though no vendor advisory or patch information is referenced in the provided sources. The EPSS score remains flat at 0.0125 with no observed rise, indicating limited exploitation interest to date.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-31610
Vulnerability details
A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setFirewallType of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument firewallType leads to os command injection. The…
more
attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in the web management interface (setFirewallType in cstecgi.cgi) directly enables remote exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the firewallType argument to block OS command injection via the cstecgi.cgi endpoint.
Enforces access-control checks on the unauthenticated setFirewallType function before any command execution can occur.
Restricts remote management-interface access, limiting the attack surface that allows unauthenticated command injection.