Description
A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-05-25
Score: 9.3 Critical
EPSS: 3.3% Low
KEV: No
Impact: Remote OS Command Injection
Action: Patch Now
AI Analysis

Impact

A flaw in the UploadFirmwareFile function of /cgi-bin/cstecgi.cgi on Totolink A8000RU routers permits injection of arbitrary shell commands through the FileName parameter, allowing an attacker to execute arbitrary commands remotely via the web interface.

Affected Systems

The affected product is the Totolink A8000RU router with firmware 7.1cu.643_b20200521. The web management interface is the touch point; no other firmware versions are explicitly mentioned.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity. The EPSS score of 3% indicates that exploitation is considered possible. The flaw is not listed in CISA's KEV catalog. Attackers can reach the vulnerable endpoint remotely via the web interface and provide a crafted FileName that triggers the command injection. Public disclosure of the exploit indicates that exploitation code is available.

Generated by OpenCVE AI on September 26, 2026 at 07:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the latest Totolink firmware that contains a fix for the UploadFirmwareFile command injection.
  • If a firmware update is unavailable, block or restrict access to /cgi-bin/cstecgi.cgi, disable the firmware upload function, or limit remote management to trusted IP ranges.
  • Implement strict input validation on the FileName field to allow only safe characters and prevent direct shell invocation.

Generated by OpenCVE AI on September 26, 2026 at 07:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 26 May 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 25 May 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a8000ru
Vendors & Products Totolink a8000ru

Mon, 25 May 2026 13:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Title Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection
First Time appeared Totolink
Totolink a8000ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a8000ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a8000ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A8000ru A8000ru Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-05-26T14:53:49.974Z

Reserved: 2026-05-24T07:57:25.850Z

Link: CVE-2026-9457

cve-icon Vulnrichment

Updated: 2026-05-26T14:53:45.218Z

cve-icon NVD

Status : Deferred

Published: 2026-05-25T14:16:28.683

Modified: 2026-07-23T11:10:00.120

Link: CVE-2026-9457

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T07:15:06Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')