CVE-2026-9436
CriticalSummary
A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521 affecting the function setL2tpServerCfg in the file /cgi-bin/cstecgi.cgi of the Web Management Interface. Manipulating the argument enable can lead to OS command injection.
Risk Assessment
An attacker can remotely exploit this vulnerability, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update the software to the latest version to mitigate this vulnerability and to monitor the system for unauthorized activities.
Original NVD description (English source)
A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used.