Executive brief
A vulnerability exists in the Totolink A8000RU wireless router, a device used to provide internet connectivity and local networking. An attacker can remotely send a specially crafted request to the router's management interface to take full control of the device. This could lead to the interception of network traffic, unauthorized access to the local network, or a complete shutdown of internet services.
Technical details
An OS command injection vulnerability exists in the Totolink A8000RU firmware version 7.1cu.643_b20200521. The flaw is located within the 'setDdnsCfg' function of the '/cgi-bin/cstecgi.cgi' component. The application fails to properly sanitize the 'provider' parameter before passing it to the 'Uci_Set_Str' and 'CsteSystem' functions, where it is eventually executed via 'execv()'. A remote, unauthenticated attacker can exploit this by sending a crafted JSON POST request containing shell metacharacters (e.g., backticks or pipes) in the 'provider' field. Successful exploitation results in arbitrary command execution as the root user. Public exploit code is available.
Affected products
- Totolink A8000RU 7.1cu.643_b20200521
Timeline
- 2026-05-24: disclosed: Vulnerability details and PoC published via GitHub and VulDB.
- 2026-05-24: advisory: CVE-2026-9404 assigned.