CVE-2026-9475

Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection

CVSS 9.3 CRITICALEPSS 1.9%CWE-77 CWE-78

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument Comment causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Productos afectados

Totolink · A8000RU

PoCs públicas encontradas — 1

cve_referencegithub.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_347/README.mdno verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_347/README.md https://vuldb.com/submit/813458 https://vuldb.com/vuln/365456 https://vuldb.com/vuln/365456/cti https://www.totolink.net/