CVE-2026-9457: Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection
A vulnerability was determined in Totolink A8000RU 7.1cu.643b20200521. The affected element is the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If supported, disable firmware upload via the web management interface (UploadFirmwareFile endpoint) and disable remote/ WAN web management. If full disable is not possible, restrict access so only trusted LAN IPs can reach the web management interface.
Totolink A8000RU Web Management Interface (/cgi-bin/cstecgi.cgi - UploadFirmwareFile) firmware_upload / remote_web_management = disabled or limited to LAN/trusted IPs - Compensating control
Block or restrict access to the device management ports and the web management interface at network perimeter firewalls or ACLs. Deny HTTP/HTTPS access to /cgi-bin/cstecgi.cgi from untrusted networks and the Internet; allow only specific trusted management IPs or VPN access.
- Operational
If the device was exposed or compromise is suspected (exploit has been publicly disclosed), isolate the device from networks, perform a factory reset or reflash firmware from the vendor source, and change all administrative credentials. Review logs for requests to /cgi-bin/cstecgi.cgi (UploadFirmwareFile) and other indicators of exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9457?
CVE-2026-9457 has a critical severity rating of 9.8.
How does CVE-2026-9457 affect the Totolink A8000RU?
CVE-2026-9457 allows for OS command injection through the UploadFirmwareFile function in the web management interface.
What are the potential impacts of exploiting CVE-2026-9457?
Exploitation of CVE-2026-9457 can lead to unauthorized command execution on the affected device.
How can I mitigate CVE-2026-9457?
To mitigate CVE-2026-9457, it is recommended to apply patches or updates provided by the manufacturer.
Is there a known fix for CVE-2026-9457?
As of now, there are no specific details on a permanent fix available for CVE-2026-9457.