← volver
CVE-2026-9404

Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection

CVSS 9.3 CRITICALEPSS 1.7%CWE-77CWE-78
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument provider leads to os command injection. The attack may be launched remotely. The exploit is publicly available and might be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Productos afectados
Totolink · A8000RU
PoCs públicas encontradas — 1
cve_referencegithub.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_336/README.mdno verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →
Referencias
https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_336/README.mdhttps://vuldb.com/submit/813439https://vuldb.com/vuln/365385https://vuldb.com/vuln/365385/ctihttps://www.totolink.net/