CVE-2026-9408: Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection
A vulnerability was detected in Totolink A8000RU 7.1cu.643b20200521. Affected by this issue is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument enable results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Because the issue is an os command injection in Totolink A8000RU Web Management Interface (/cgi-bin/cstecgi.cgi, function setStaticDhcpRules) exploitable remotely, restrict access to the Web Management Interface from remote clients (e.g., allow only trusted IPs / networks to reach the management UI and block all other inbound access).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9408?
CVE-2026-9408 has a critical severity rating of 9.8.
How do I fix CVE-2026-9408?
To mitigate CVE-2026-9408, update the firmware of the Totolink A8000RU device to the latest version.
What type of vulnerability is CVE-2026-9408?
CVE-2026-9408 is classified as an OS Command Injection vulnerability.
What are the potential impacts of CVE-2026-9408?
Exploitation of CVE-2026-9408 can lead to unauthorized execution of commands on the affected device.
Which component is affected by CVE-2026-9408?
CVE-2026-9408 affects the Web Management Interface of the Totolink A8000RU device.