CVE-2026-9435

Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection

CVSS 9.3 CRITICALEPSS 1.9%CWE-77 CWE-78

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setQosCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument enable results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Affected products

Totolink · A8000RU

public PoCs found — 1

cve_referencegithub.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_356/README.mdunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_356/README.md https://vuldb.com/submit/813908 https://vuldb.com/vuln/365416 https://vuldb.com/vuln/365416/cti https://www.totolink.net/