CVE-2026-9436

EUVD-2026-31644
A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
Common Weakness Enumeration
References
https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_357/README.md
https://vuldb.com/submit/813461
https://vuldb.com/submit/813909
https://vuldb.com/vuln/365417
https://vuldb.com/vuln/365417/cti
https://www.totolink.net/