CVE-2026-9384: Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection
A vulnerability was found in Totolink A8000RU 7.1cu.643b20200521. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument ip results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable remote/web management access or restrict management to the trusted management network (LAN) so the Web Management Interface is not reachable from untrusted/WAN networks.
Totolink A8000RU Web Management Interface (cstecgi.cgi) remote_management_access = disabled / LAN-only - Compensating control
Block or restrict access to /cgi-bin/cstecgi.cgi and management HTTP endpoints at network perimeter devices (firewall/ACL/WAF). Allow only trusted management IPs and block requests invoking the setDiagnosisCfg action or containing the ip parameter where possible.
- Compensating control
Isolate or disconnect affected Totolink A8000RU devices from the network until mitigations (above) are applied or vendor fixes become available.
- Operational
Search web server and network logs for requests to /cgi-bin/cstecgi.cgi, for use of setDiagnosisCfg, and for anomalous command execution. If indicators of compromise are found, isolate the affected device(s), perform a factory reset or reflash firmware, and rotate administrative credentials.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9384?
CVE-2026-9384 has a critical severity rating of 9.8.
What is the impact of CVE-2026-9384?
CVE-2026-9384 allows for OS command injection through the Web Management Interface of the Totolink A8000RU.
How can I mitigate CVE-2026-9384?
Mitigation for CVE-2026-9384 involves applying the latest firmware updates or disabling the affected web management interface.
What components are affected by CVE-2026-9384?
CVE-2026-9384 affects the setDiagnosisCfg function in the cstecgi.cgi file of the Totolink A8000RU.
Can CVE-2026-9384 be exploited remotely?
Yes, CVE-2026-9384 can be exploited remotely due to the nature of the vulnerability.