CVE-2026-9436 CRITICAL

CVE-2026-9436: Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection

Vendor Totolink

Product A8000RU

Weakness CWE-78

Published May 25, 2026

Last update May 28, 2026

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used.

Key dates

02Disclosure timeline

May 25, 2026 CVE published

May 28, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-9436

Related vulnerabilities

04Related CVE

CVE-2026-28291 simple-git has Command Execution via Option-Parsing Bypass CVE-2026-41900 OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment CVE-2025-54795 Claude Code echo command allowed bypass of user approval prompt for command execution CVE-2026-23759 Perle IOLAN STS/SCS Authenticated Command Injection via 'shell ps' CVE-2025-66261 Unauthenticated OS Command Injection (restore_settings.php)