CVE-2026-9407: Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection
A security vulnerability has been detected in Totolink A8000RU 7.1cu.643b20200521. Affected by this vulnerability is the function setFirewallType of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument firewallType leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Totolink A8000RU /cgi-bin/cstecgi.cgifrom your environment.Remove, rename, or otherwise disable execution of /cgi-bin/cstecgi.cgi on affected devices to prevent use of the vulnerable setFirewallType function.
- Configuration
Disable remote web management (disable remote/Internet access to the router's web UI) to prevent remote exploitation of /cgi-bin/cstecgi.cgi setFirewallType.
Web Management Interface remote_management = disabled - Compensating control
Restrict access to the device management interface to trusted IPs or an internal management network using firewall rules or ACLs; block WAN access to HTTP/HTTPS and specifically to /cgi-bin/cstecgi.cgi at the network edge.
- Operational
Inspect device and network logs for requests to /cgi-bin/cstecgi.cgi and signs of exploitation; if compromise is suspected, perform incident response steps such as isolating the device and rotating any credentials that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9407?
CVE-2026-9407 has a critical severity rating of 9.8.
How can I fix CVE-2026-9407?
To mitigate CVE-2026-9407, update the Totolink A8000RU firmware to the latest version provided by the vendor.
What does CVE-2026-9407 affect?
CVE-2026-9407 affects the setFirewallType function within the cstecgi.cgi file of the Totolink A8000RU Web Management Interface.
What type of vulnerability is CVE-2026-9407?
CVE-2026-9407 is classified as an operating system command injection vulnerability.
How is CVE-2026-9407 exploited?
CVE-2026-9407 can be exploited by manipulating the firewallType argument, leading to OS command injection.