CVE-2026-9454
Published: 25 May 2026
Summary
CVE-2026-9454 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 22.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
A flaw has been identified in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The issue resides in the setOpenVpnCertGenerationCfg function within the /cgi-bin/cstecgi.cgi file of the web management interface, where improper handling of the servername argument permits OS command injection. The vulnerability is tracked as CVE-2026-9454, carries a CVSS 4.0 score of 8.9, and is associated with CWE-77 and CWE-78.
An unauthenticated attacker can exploit the flaw remotely by sending a crafted HTTP request to the web interface, resulting in arbitrary command execution on the device with no user interaction required. Publicly available exploit code has been released, enabling straightforward reproduction of the attack against exposed devices.
The EPSS score remains flat at 0.0125 with no material increase since disclosure. Reference materials point to detailed proof-of-concept information on public repositories and vulnerability databases, while the vendor site offers no specific mitigation guidance in the available records.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-31670
Vulnerability details
A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setOpenVpnCertGenerationCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument servername can lead to os command injection. The attack…
more
may be launched remotely. The exploit has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote OS command injection in web management interface directly enables T1190 (public-facing app exploitation) and Unix shell command execution via T1059.004.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the servername argument before it is passed to OS commands in setOpenVpnCertGenerationCfg.
Restricts external network access to the web management interface (/cgi-bin/cstecgi.cgi), blocking remote unauthenticated exploitation of the injection flaw.
Enforces authentication and authorization checks before allowing any access to management functions that accept attacker-controlled input.