CVE-2026-9458
Published: 25 May 2026
Summary
CVE-2026-9458 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability identified as CVE-2026-9458 affects the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. It resides in the setWanCfg function within the /cgi-bin/cstecgi.cgi file of the web management interface, where improper handling of the enabled argument permits OS command injection. The issue is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9, reflecting network-accessible attack vectors that require no authentication or user interaction.
Remote, unauthenticated attackers can supply crafted input to the affected parameter and execute arbitrary operating system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the router, with a publicly available proof-of-concept exploit already disclosed.
Reference materials include a GitHub repository containing reproduction details, multiple Vuldb entries, and the vendor website, yet none of the listed sources describe available patches, firmware updates, or specific mitigation steps. The EPSS score remains flat at 0.0125 with no observed increase after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-31678
Vulnerability details
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument enabled leads to os command injection. The attack may be…
more
performed from remote. The exploit is publicly available and might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote OS command injection in web management interface directly enables T1190 exploitation of public-facing app and Unix shell command execution via T1059.004.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the 'enabled' argument in setWanCfg to block OS command injection via the CGI interface.
Restricts network exposure of the unauthenticated web management interface (/cgi-bin/cstecgi.cgi) to trusted sources only.
Enforces authentication and authorization checks before any invocation of setWanCfg, eliminating the unauthenticated attack vector.