CVE-2026-9388: Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection

Published May 24, 2026

Updated

A weakness has been identified in Totolink A8000RU 7.1cu.643b20200521. The impacted element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument mode can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

Affected Software

1 affected component

TOTOLINK A8000RU=7.1cu.643_b20200521

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove Totolink A8000RU /cgi-bin/cstecgi.cgi from your environment.
If feasible, remove or rename /cgi-bin/cstecgi.cgi or remove execute permissions for the script so the setScheduleCfg endpoint cannot be invoked. If removal is not possible, restrict access to the file (see compensating controls).
Configuration
Disable remote (WAN) web management access in the router administration settings to prevent remote exploitation of /cgi-bin/cstecgi.cgi (setScheduleCfg).
Totolink A8000RU Web Management Interface remote_management = disabled
Compensating control
Restrict access to the router's web management interface to trusted IP addresses only (via firewall, ACL, or network segmentation). Block WAN access to HTTP/HTTPS management ports to prevent remote exploitation.
Operational
Monitor device logs for requests to /cgi-bin/cstecgi.cgi and invocations of setScheduleCfg; isolate or take offline any device exhibiting suspicious activity.
Operational
Apply any vendor-supplied firmware/security updates for the Totolink A8000RU addressing this vulnerability as soon as they become available.

Event History

May 24, 2026

CVE Published

via MITRE·02:30 PM

Data Sourced

via MITRE·02:30 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Apr 28, 58520

Event

via FIRST·12:49 PM

Frequently Asked Questions

What is the severity of CVE-2026-9388?

CVE-2026-9388 has a critical severity score of 9.8.

How do I fix CVE-2026-9388?

To mitigate CVE-2026-9388, update the firmware of the Totolink A8000RU to the latest version provided by the vendor.

What type of vulnerability is CVE-2026-9388?

CVE-2026-9388 is categorized as an OS command injection vulnerability.

What component is affected by CVE-2026-9388?

CVE-2026-9388 affects the Web Management Interface of the Totolink A8000RU.

What can attackers do with CVE-2026-9388?

Attackers can exploit CVE-2026-9388 to execute arbitrary OS commands on the vulnerable device.