CVE-2026-9476

CRITICAL 9.8CVE-2026-9476 · Published 25/05/2026 · updated 23/07/2026

In short

CVE-2026-9476 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument admpass leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used.

References

Litengzheng/vuldb_new2
vuldb.com/submit/813459
vuldb.com/vuln/365457
vuldb.com/vuln/365457/cti
totolink.net

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free