CVE-2026-9408

8.9 highEPSS 1.7%

High (8.9). EPSS 1.7% chance of exploitation in the next 30 days.

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument enable results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.

Severity

CVSS 4.0

8.9 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWEs: CWE-77, CWE-78
Published: 2026-05-25
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

References

https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_340/README.md
https://vuldb.com/submit/813443
https://vuldb.com/vuln/365389
https://vuldb.com/vuln/365389/cti
https://www.totolink.net/

Check your stack JSON