Executive brief
The Totolink A8000RU router, a device used to provide wireless internet connectivity, contains a critical security flaw in its web management interface. An attacker can exploit this vulnerability to take complete control of the router by sending a specially crafted network request. This could lead to the interception of internet traffic, unauthorized access to the local network, or a total disruption of internet service.
Technical details
An OS command injection vulnerability exists in the Totolink A8000RU router (firmware version 7.1cu.643_b20200521) within the 'setMacFilterRules' function of the /cgi-bin/cstecgi.cgi component. The vulnerability is rooted in the improper sanitization of the 'enable' parameter, which is passed to the 'Uci_Set_Str' function and eventually executed via 'execv()' through the 'CsteSystem' function. A remote, unauthenticated attacker can exploit this by sending a crafted POST request containing shell metacharacters (e.g., backticks) in the 'enable' field. Successful exploitation allows for arbitrary command execution with the privileges of the web server, potentially leading to full system compromise. A public exploit (PoC) is available.
Affected products
- Totolink A8000RU 7.1cu.643_b20200521
Timeline
- 2026-05-25: disclosed: Vulnerability details and PoC published via GitHub and VulDB.
- 2026-05-25: advisory: CVE-2026-9433 published.