ByteOS Network

CVE Vulnerability Details :

CVE-2026-9454

PUBLISHED

More Info Official Page

Assigner-VulDB

Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5

Published At-25 May, 2026 | 11:30

Updated At-25 May, 2026 | 11:30

▼CVE Numbering Authority (CNA)

Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setOpenVpnCertGenerationCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument servername can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used.

Affected Products

Vendor

TOTOLINK

Product

A8000RU

CPEs

cpe:2.3:o:totolink:a8000ru_firmware:*:*:*:*:*:*:*:*

Modules

Web Management Interface

Versions

Affected

7.1cu.643_b20200521

Problem Types

Type	CWE ID	Description
CWE	CWE-78	OS Command Injection
CWE	CWE-77	Command Injection

Type: CWE

CWE ID: CWE-78

Description: OS Command Injection

Type: CWE

CWE ID: CWE-77

Description: Command Injection

Metrics

Version	Base score	Base severity	Vector
4.0	9.3	CRITICAL	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
3.0	9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
2.0	10.0	N/A	AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR

Version: 4.0

Base score: 9.3

Base severity: CRITICAL

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

Version: 3.0

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

Version: 2.0

Base score: 10.0

Base severity: N/A

Vector:

AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR

Credits

reporter

LtzHust (VulDB User)

Timeline

Event	Date
Advisory disclosed	2026-05-24 00:00:00
VulDB entry created	2026-05-24 02:00:00
VulDB entry last update	2026-05-24 10:03:20

Event: Advisory disclosed

Date: 2026-05-24 00:00:00

Event: VulDB entry created

Date: 2026-05-24 02:00:00

Event: VulDB entry last update

Date: 2026-05-24 10:03:20

References

Hyperlink	Resource
https://vuldb.com/vuln/365435	vdb-entry technical-description
https://vuldb.com/vuln/365435/cti	signature permissions-required
https://vuldb.com/submit/813447	third-party-advisory
https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_341/README.md	exploit
https://www.totolink.net/	product