CVE-2026-9476: Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection

Published May 25, 2026

Updated

A vulnerability was identified in Totolink A8000RU 7.1cu.643b20200521. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument admpass leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used.

Affected Software

1 affected component

TOTOLINK A8000RU=7.1cu.643_b20200521

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove Totolink A8000RU /cgi-bin/cstecgi.cgi from your environment.
If feasible, remove or disable the /cgi-bin/cstecgi.cgi endpoint or otherwise prevent execution of the vulnerable setPasswordCfg functionality to eliminate the os command injection vector.
Configuration
Disable the router's remote/web management interface if it is not required. If remote management is required, restrict it to specific trusted IPs only.
Totolink A8000RU Web Management Interface remote_management = disabled
Compensating control
Restrict access to the device's web management endpoints (e.g., ports 80/443 and /cgi-bin/cstecgi.cgi) at the network edge or host firewall. Block access from the WAN and allow only the LAN or designated administrator IP addresses.

Event History

May 25, 2026

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Jun 29, 58383

Event

via FIRST·01:30 PM

Frequently Asked Questions

What is the severity of CVE-2026-9476?

CVE-2026-9476 has a severity rating of critical, with a CVSS score of 9.8.

What kind of vulnerability is CVE-2026-9476?

CVE-2026-9476 is an OS command injection vulnerability affecting the Totolink A8000RU.

How can CVE-2026-9476 be exploited?

CVE-2026-9476 can be exploited by manipulating the 'admpass' argument in the setPasswordCfg function within the web management interface.

How do I fix CVE-2026-9476?

To fix CVE-2026-9476, it is recommended to update the Totolink A8000RU to the latest firmware that addresses this vulnerability.

What devices are affected by CVE-2026-9476?

CVE-2026-9476 affects the Totolink A8000RU model with firmware version 7.1cu.643_b20200521.