CVE-2026-9477: Totolink A8000RU RCE Vulnerability

CVE-2026-9477 Overview

CVE-2026-9477 is an operating system command injection vulnerability in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The flaw exists in the setAccessDeviceCfg function within /cgi-bin/cstecgi.cgi, a component of the Web Management Interface. Attackers manipulate the mac argument to inject arbitrary operating system commands. The vulnerability is exploitable remotely over the network and requires no authentication or user interaction. Public exploit details have been released, increasing the risk of opportunistic attacks against exposed devices. The issue is classified under CWE-77 for improper neutralization of special elements used in a command.

Critical Impact

Unauthenticated remote attackers can execute arbitrary OS commands on affected Totolink A8000RU routers, leading to full device compromise and potential pivoting into the internal network.

Affected Products

• Totolink A8000RU router
• Firmware version 7.1cu.643_b20200521
• Web Management Interface component /cgi-bin/cstecgi.cgi

Discovery Timeline

• 2026-05-25 - CVE-2026-9477 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9477

Vulnerability Analysis

The vulnerability resides in the setAccessDeviceCfg function exposed through the CGI endpoint /cgi-bin/cstecgi.cgi on the router's Web Management Interface. The function accepts a mac parameter from HTTP requests and incorporates it into an operating system command without proper sanitization or neutralization of shell metacharacters. An unauthenticated attacker on the network sends a crafted request containing shell command separators within the mac field. The router's underlying shell then executes the injected commands with the privileges of the web server process, typically root on embedded Linux devices. Successful exploitation enables arbitrary command execution, configuration modification, credential theft, firmware tampering, and use of the device as a foothold for lateral movement.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The setAccessDeviceCfg handler passes user-controlled input from the mac parameter directly to a system shell invocation. The absence of input validation, allowlisting, or safe API usage permits metacharacters such as semicolons, backticks, and pipes to terminate the intended command and append attacker-supplied commands.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP POST request to /cgi-bin/cstecgi.cgi targeting the setAccessDeviceCfg function with a malicious mac parameter value. Internet-exposed router management interfaces are at the highest risk. Where remote management is disabled, an adversary on the local network or one who already controls a client device can still reach the vulnerable endpoint.

No verified proof-of-concept code is reproduced here. See the GitHub README for Vulnerability and the VulDB Vulnerability #365458 entry for technical details published by the reporters.

Detection Methods for CVE-2026-9477

Indicators of Compromise

• HTTP requests to /cgi-bin/cstecgi.cgi containing shell metacharacters (;, |, `, $(), &&) inside the mac parameter.
• Unexpected outbound connections from the router to attacker-controlled infrastructure shortly after CGI requests.
• Unauthorized changes to router configuration, DNS settings, or firmware images.
• New processes or persistence artifacts on the device that do not match the vendor baseline.

Detection Strategies

• Inspect network flows and web proxy logs for POST requests to /cgi-bin/cstecgi.cgi referencing setAccessDeviceCfg with non-MAC-format values in mac.
• Deploy IDS/IPS signatures that match command injection patterns targeting Totolink CGI endpoints.
• Correlate router management traffic with workstation activity to identify unauthorized administrative requests.

Monitoring Recommendations

• Forward router syslog and HTTP access logs to a centralized SIEM for retention and analysis.
• Alert on any access to the Web Management Interface from external or non-administrative source addresses.
• Track baseline router behavior such as DNS resolvers, firmware hashes, and listening services to identify deviations.

How to Mitigate CVE-2026-9477

Immediate Actions Required

• Disable remote administration (WAN-side access) on the Totolink A8000RU until a vendor fix is verified.
• Restrict LAN access to the Web Management Interface using ACLs or VLAN segmentation, limiting it to known administrative hosts.
• Replace default credentials and rotate any router-stored secrets such as VPN keys or DDNS tokens.
• Inspect routers for signs of compromise and reset to factory defaults followed by reconfiguration if tampering is suspected.

Patch Information

At the time of publication, no vendor patch is referenced in the available advisories. Monitor the Totolink Security Information page for firmware updates addressing the setAccessDeviceCfg command injection. Apply firmware updates promptly once they become available, and verify the integrity of downloaded images before installation.

Workarounds

• Block external access to TCP ports used by the router's Web Management Interface at the upstream firewall.
• Place the router behind a perimeter device that filters HTTP requests containing shell metacharacters in CGI parameters.
• Replace end-of-life or unsupported hardware with devices that receive active security maintenance if no patch is released.

# Configuration example: block WAN access to the router admin interface
# Example iptables rule applied on an upstream firewall
iptables -A FORWARD -d <router_wan_ip> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <router_wan_ip> -p tcp --dport 443 -j DROP

# Example Snort-style alert for suspicious mac parameter content
alert tcp any any -> any 80 (msg:"Totolink A8000RU setAccessDeviceCfg command injection attempt"; \
  content:"/cgi-bin/cstecgi.cgi"; http_uri; \
  content:"setAccessDeviceCfg"; http_client_body; \
  pcre:"/mac=[^&]*[;|`$()&]/"; sid:2026947701; rev:1;)