CVE-2026-9385: Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection
A vulnerability was determined in Totolink A8000RU 7.1cu.643b20200521. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument command causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the web management interface (HTTP/HTTPS) and remote administration on the device until a vendor patch/fix is available to prevent remote exploitation of cstecgi.cgi.
Totolink A8000RU Web Management Interface web_management_interface_enabled = false - Configuration
Block or restrict access to /cgi-bin/cstecgi.cgi (particularly the setTracerouteCfg endpoint) via device configuration or webserver rules to prevent remote command injection.
Totolink A8000RU Web Management Interface (/cgi-bin/cstecgi.cgi) access_to_/cgi-bin/cstecgi.cgi = blocked - Compensating control
Restrict access to the router's management interfaces to trusted administrative IPs using firewall rules, network ACLs, or by placing the device on an isolated management VLAN to limit exposure to the internet.
- Operational
Monitor device logs for attempts to exploit setTracerouteCfg; if exploitation or compromise is suspected, isolate the device from the network and recover it (for example: factory reset and reconfigure from a known-good backup).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9385?
The severity of CVE-2026-9385 is critical with a CVSS score of 9.8.
What type of vulnerability is CVE-2026-9385?
CVE-2026-9385 is categorized as an OS command injection vulnerability.
How does CVE-2026-9385 impact the Totolink A8000RU?
CVE-2026-9385 allows attackers to execute arbitrary operating system commands through a vulnerable web management interface.
How do I fix CVE-2026-9385?
To fix CVE-2026-9385, it is recommended to update the Totolink A8000RU firmware to the latest version that addresses this vulnerability.
What component is affected by CVE-2026-9385?
CVE-2026-9385 affects the setTracerouteCfg function in the cstecgi.cgi file of the web management interface.