CVE-2026-9408

Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection

CVSS 9.3 CRITICALEPSS 1.7%CWE-77 CWE-78

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument enable results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Productos afectados

Totolink · A8000RU

PoCs públicas encontradas — 1

cve_referencegithub.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_340/README.mdno verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_340/README.md https://vuldb.com/submit/813443 https://vuldb.com/vuln/365389 https://vuldb.com/vuln/365389/cti https://www.totolink.net/