CVE-2026-9405: Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection
A security flaw has been discovered in Totolink A8000RU 7.1cu.643b20200521. This impacts the function setGameSpeedCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument enable results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9405?
CVE-2026-9405 has a critical severity rating of 9.8.
What type of vulnerability is identified in CVE-2026-9405?
CVE-2026-9405 is identified as an OS command injection vulnerability.
How can I mitigate the CVE-2026-9405 vulnerability?
Mitigation for CVE-2026-9405 involves ensuring that the firmware of Totolink A8000RU is updated to the latest version with security patches.
Who is affected by CVE-2026-9405?
CVE-2026-9405 affects users of Totolink A8000RU routers running version 7.1cu.643_b20200521.
What is the potential impact of exploiting CVE-2026-9405?
Exploitation of CVE-2026-9405 could allow remote attackers to execute arbitrary operating system commands.