CVE-2026-9455
Published: 25 May 2026
Summary
CVE-2026-9455 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 22.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
A vulnerability has been found in the Totolink A8000RU router running firmware 7.1cu.643_b20200521. It resides in the UploadOpenVpnCert function of the file /cgi-bin/cstecgi.cgi within the Web Management Interface. Manipulation of the FileName argument allows OS command injection, as indicated by the associated CWEs 77 and 78. The issue is remotely exploitable over the network without requiring authentication or user interaction, resulting in a CVSS 4.0 score of 8.9.
An unauthenticated remote attacker can supply a crafted FileName value to the web interface and achieve arbitrary command execution on the underlying operating system. This grants full control over the device, including the ability to read, modify, or delete data and potentially pivot to other systems on the network. Publicly available exploit details confirm the attack vector is functional.
The EPSS score remains flat at 0.0125 with no material increase since disclosure. References point to a public GitHub repository containing reproduction steps, multiple Vuldb entries, and the vendor site, but no specific mitigation guidance or patch details are provided in the available sources.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-31673
Vulnerability details
A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument FileName leads to os command injection. Remote exploitation of the…
more
attack is possible. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in publicly accessible web management interface directly enables remote exploitation of the device (T1190) and arbitrary command execution via Unix shell (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates the FileName argument in UploadOpenVpnCert to block OS command injection payloads before execution.
Restricts network exposure of the unauthenticated /cgi-bin/cstecgi.cgi web interface, limiting remote attack surface.
Enforces access control checks on CGI functions so unauthenticated requests to UploadOpenVpnCert are rejected.