CVE-2026-9386: Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection
A vulnerability was identified in Totolink A8000RU 7.1cu.643b20200521. Impacted is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument lang leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable remote/remote WAN web management/administration in the router's Web Management Interface to prevent remote access to cstecgi.cgi (set management access to disabled for WAN/remote interfaces).
Totolink A8000RU Web Management Interface remote_management = disabled - Configuration
Restrict the web management interface so it is accessible only from the LAN or from specific trusted IP addresses; disable access from the WAN/Internet.
Totolink A8000RU Web Management Interface management_access = LAN-only or specific trusted IPs - Compensating control
Block or filter access to the router's management ports (HTTP/HTTPS) and to the /cgi-bin/cstecgi.cgi endpoint from untrusted networks at perimeter firewalls, NAT rules, or a WAF; allow access only from trusted management networks.
- Operational
Rotate administrative credentials (change all router/admin passwords) and review device logs for signs of exploitation. Isolate or factory-reset devices suspected of compromise and preserve logs for investigation. Apply any vendor-supplied firmware update as soon as it becomes available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9386?
CVE-2026-9386 has a critical severity rating of 9.8.
How do I fix CVE-2026-9386?
To fix CVE-2026-9386, update the firmware of the Totolink A8000RU to the latest version provided by the manufacturer.
What type of vulnerability is CVE-2026-9386?
CVE-2026-9386 is an OS command injection vulnerability affecting the Web Management Interface of the Totolink A8000RU.
Can CVE-2026-9386 be exploited remotely?
Yes, CVE-2026-9386 can be exploited remotely, allowing attackers to execute OS commands.
What component is affected by CVE-2026-9386?
CVE-2026-9386 affects the setLanguageCfg function within the cstecgi.cgi file of the Totolink A8000RU Web Management Interface.