CVE-2026-9434: Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection
A security vulnerability has been detected in Totolink A8000RU 7.1cu.643b20200521. Impacted is the function setWiFiWpsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument wscDisabled leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Totolink A8000RUto a version that resolves this vulnerability.Fixed in 7.1cu.643_b20200521 - Compensating control
Because the Web Management Interface endpoint /cgi-bin/cstecgi.cgi (function setWiFiWpsCfg) is remotely exploitable via argument wscDisabled leading to OS command injection, restrict access to the device’s web management interface to trusted IPs (e.g., via firewall/ACL) to prevent remote exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9434?
The severity of CVE-2026-9434 is classified as critical with a score of 9.8.
How do I fix CVE-2026-9434?
To fix CVE-2026-9434, update the Totolink A8000RU firmware to the latest version provided by the manufacturer.
What type of vulnerability is CVE-2026-9434?
CVE-2026-9434 is an OS command injection vulnerability affecting the web management interface.
Which component is affected by CVE-2026-9434?
CVE-2026-9434 affects the function setWiFiWpsCfg in the cstecgi.cgi file of the Totolink A8000RU.
What can an attacker achieve with CVE-2026-9434?
An attacker can exploit CVE-2026-9434 to execute arbitrary operating system commands on the affected device.