CVE-2026-9405 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-9405 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-9405 is a critical-severity vulnerability affecting the web management interface of the Totolink A8000RU router (firmware version 7.1cu.643_b20200521), specifically within the setGameSpeedCfg function exposed through the /cgi-bin/cstecgi.cgi endpoint.

Technical Detail

The flaw resides in the setGameSpeedCfg function of the device's CGI-based web management interface, where insufficient input validation likely enables a stack-based or heap-based buffer overflow or command injection condition. An attacker capable of reaching the management interface can send a crafted HTTP request to /cgi-bin/cstecgi.cgi to trigger the vulnerable function. Successful exploitation could result in unauthenticated remote code execution with the privileges of the web server process, which on embedded devices of this class typically runs as root.

Exploitation Status

No known exploit code has been publicly observed or confirmed as of May 31, 2026. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as no known exploit, though the CVSS score of 9.8 reflects the severity of the attack vector and potential impact if exploitation were to occur.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this CVE. Totolink devices as a product class have historically attracted attention from botnet operators targeting SOHO routers, but no such activity has been linked to this specific vulnerability.

What To Do

Organizations and individuals operating the Totolink A8000RU on firmware version 7.1cu.643_b20200521 should check the Totolink vendor portal for an updated firmware release and apply it immediately given the critical CVSS rating of 9.8. If no patch is yet available, restrict access to the web management interface by disabling remote management, placing the interface behind a firewall or VPN, and ensuring it is not exposed to the public internet. Network defenders should monitor for anomalous HTTP POST requests targeting /cgi-bin/cstecgi.cgi with oversized or malformed parameters as a potential detection signal. Given the lack of a confirmed patch timeline, isolation of affected devices from untrusted network segments is a prudent interim control.