CVE-2026-9435
Published: 25 May 2026
Summary
CVE-2026-9435 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 22.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability identified as CVE-2026-9435 affects the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. It resides in the setQosCfg function within the /cgi-bin/cstecgi.cgi file of the web management interface and stems from improper handling of the enable argument, resulting in operating system command injection. The issue is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9, reflecting network-accessible attack vectors with no required authentication or user interaction.
An unauthenticated remote attacker can supply a crafted request to the web interface that injects and executes arbitrary operating system commands on the device. Successful exploitation grants full control over the router, enabling actions such as configuration changes, traffic interception, or persistence mechanisms. Public exploit code for this flaw has been released.
The EPSS score remains flat at 0.0125 with no material increase observed after disclosure. Reference materials point to a detailed proof-of-concept on GitHub and entries on Vuldb, along with the vendor site, though no specific patch or mitigation guidance is detailed in the available sources.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-31643
Vulnerability details
A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setQosCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument enable results in os command injection. Remote exploitation of…
more
the attack is possible. The exploit is now public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct OS command injection in publicly exposed web management interface enables remote exploitation (T1190) and Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the 'enable' argument in setQosCfg to block OS command injection via the web interface.
Enforces authentication and authorization checks before any web-management function such as setQosCfg can be invoked.
Restricts network reachability of the unauthenticated /cgi-bin/cstecgi.cgi endpoint from external attackers.