CVE-2026-9433
Published: 25 May 2026
Summary
CVE-2026-9433 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
A weakness has been identified in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The issue resides in the setMacFilterRules function within the /cgi-bin/cstecgi.cgi file of the Web Management Interface component. Improper handling of the enable argument permits operating system command injection, as indicated by the associated CWE-77 and CWE-78 classifications. The vulnerability is remotely exploitable without authentication and carries a CVSS 4.0 score of 8.9.
An attacker with network access can supply crafted input to the affected CGI endpoint and execute arbitrary operating system commands on the device. Because a public exploit is already available, unauthenticated remote parties can leverage the flaw to compromise the router's integrity, confidentiality, and availability.
The listed references point to disclosure entries on VulDB and a detailed proof-of-concept repository, along with the vendor's site, but contain no explicit statements regarding patches, firmware updates, or other mitigations. The EPSS score has remained flat at 0.0125 with no material increase observed after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-31641
Vulnerability details
A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument enable causes os command injection. The attack may be initiated…
more
remotely. The exploit has been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote OS command injection in web management interface directly enables T1190 (public-facing app exploitation) and facilitates Unix shell command execution via T1059.004.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandatory validation of the enable argument in setMacFilterRules would reject crafted OS command payloads before they reach the CGI handler.
Enforcing authenticated access on /cgi-bin/cstecgi.cgi would block unauthenticated remote callers from invoking the vulnerable function.
Boundary-protection rules can restrict the web management interface to trusted networks only, reducing remote unauthenticated exposure.