CVE-2026-9387
CriticalSummary
A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521 in the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi in the Web Management Interface. Manipulating the argument resetFlags leads to OS command injection.
Risk Assessment
This vulnerability allows for remote exploitation, posing a serious threat to organizational security. A publicly available exploit may be used by attackers.
Recommendation
It is recommended to immediately update the device firmware to the latest version to mitigate this vulnerability. Additionally, monitor systems for unauthorized activities.
Original NVD description (English source)
A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument resetFlags results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.