CVE-2026-9384 — Totolink A8000RU Router¶

Q: How do I detect CVE-2026-9384?

Deploy the Snort detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

Q: How do I block or mitigate CVE-2026-9384?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

Key facts

CVE-2026-9384 (Totolink) is a Critical (9.8) vulnerability: Totolink A8000RU Router. This entry ships ready-to-deploy detection and prevention rules (Snort) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-9384
Severity	Critical (9.8)
Vendor	Totolink
Product	Totolink A8000RU Router
Detection / prevention	Snort
PoC	poc.py
Source	2026/CVE-2026-9384/

Details¶

CVE-2026-9384 (Totolink) is a Critical (9.8) vulnerability: Totolink A8000RU Router. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort) — see Detection and prevention below. Source: NVD record.

Overview¶

Field	Value
CVE	CVE-2026-9384
CVSS	9.8 (Critical)
Vendor	Totolink
Product	Totolink A8000RU Router
Affected	Totolink A8000RU firmware 7.1cu.643 (20+ CGI function variants)
Fixed	Apply vendor firmware update; disable remote management as interim mitigation

Root Cause¶

The Totolink A8000RU router's web management interface processes HTTP requests through /cgi-bin/cstecgi.cgi. This CGI binary handles over 20 distinct administrative functions (e.g., setIpQosRules, setMacFilterRules, setPortForwardRules, setStaticDhcpRules, setVpnAccountCfg, and others). In each of these handlers, user-supplied POST parameters are extracted from the HTTP request body and passed directly to system() or popen() calls without sanitization or input validation. Shell metacharacters (; | & $ `` > <) embedded in parameter values are interpreted by the shell, enabling arbitrary command execution. The vulnerability affects all identified function variants, meaning the attack surface spans the majority of the router's configuration API.

Problem¶

An unauthenticated (or authenticated, depending on function) remote attacker with network access to the router's management interface can achieve full root-level command execution:

Remote Code Execution as root: The CGI binary runs with root privileges on the embedded Linux system; injected commands execute with full system control.
Persistent backdoor: Modify /etc/passwd, install cron jobs, or alter firewall rules to establish persistent access.
Network pivoting: Use the compromised router as a network pivot to attack devices on the LAN segment.
Credential harvesting: Extract stored VPN credentials, PPPoE passwords, and Wi-Fi PSKs from the router's NVRAM or configuration files.
Denial of Service: Execute commands that crash router processes or reboot the device, disrupting network connectivity.
Botnet recruitment: This class of router vulnerability is routinely exploited by botnets (Mirai variants) for DDoS infrastructure.

Over 20 vulnerable function variants are confirmed, making exploitation trivial with any of multiple attack vectors.

Detection¶

Run the proof-of-concept against your router's management interface:

python poc.py --target http://<router-ip>/cgi-bin/cstecgi.cgi --function setIpQosRules --cmd "id"

The PoC injects a command separator followed by a diagnostic command into a vulnerable POST parameter. Confirm exploitation by: - Observing command output in the HTTP response body - Monitoring for a DNS or HTTP callback to an attacker-controlled server - Checking for time-based delays when injecting sleep commands

Manual test example:

curl -s -X POST http://<router-ip>/cgi-bin/cstecgi.cgi \
  -d 'topicurl=setIpQosRules&qosEnabled=1;id;'

Affected function variants include (non-exhaustive): setIpQosRules, setMacFilterRules, setPortForwardRules, setStaticDhcpRules, setVpnAccountCfg, setDmzCfg, setDdnsCfg, setOpModeCfg, setAccessControlList, setParentalRules, setScheduleRules, setWifiBasicCfg, setWifiGuestCfg, setWifiSecurityCfg, setWifiWpsCfg, setRouterCfg, setNtpCfg, setSyslogCfg, setTracerouteCfg, setDiagnosisCfg

Remediation¶

Update firmware: Check Totolink's official support site for a firmware update for the A8000RU that addresses this vulnerability. Apply the update via the router's web UI (Administration → Firmware Upgrade) or TFTP recovery.
Disable remote management immediately: Log into the router admin panel and disable WAN-side HTTP/HTTPS management access (Advanced → Remote Management → Disable). This prevents exploitation from the internet while a firmware fix is applied.
Firewall ports 80 and 443: On upstream firewall/modem, block inbound TCP connections to the router's WAN IP on ports 80, 443, and 8080 to prevent internet-facing exploitation.
Isolate management access: Restrict management access to a dedicated management VLAN or specific trusted host IPs using the router's access control list.
Change default credentials: Ensure admin credentials have been changed from factory defaults, reducing the risk from authenticated variants of this vulnerability.
Consider device replacement: If no vendor patch is available and the device is internet-facing, consider replacing with a router model that receives active security support.

References¶

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-9384
Totolink Support: https://www.totolink.net/home/menu/newstpl/menu_newstpl/downloads.html
CISA ICS Advisory (Router Vulnerabilities): https://www.cisa.gov/ics-advisories

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-9384, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-9384 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signature

alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"CVE-2026-9384 Totolink A8000RU cstecgi.cgi OS command injection"; flow:to_server,established; content:"/cgi-bin/cstecgi.cgi"; http_uri; pcre:"/(?:[;&|`$]|%3b|%7c|%60|%24)\s*(?:cat|wget|curl|bash|sh|tftp|nc|rm|chmod|busybox)/i"; http_client_body; classtype:web-application-attack; sid:9002709; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"CVE-2026-9384 Totolink cstecgi.cgi topicurl param command injection"; flow:to_server,established; content:"POST"; http_method; content:"/cgi-bin/cstecgi.cgi"; http_uri; content:"topicurl"; http_client_body; pcre:"/topicurl=[^&]*(?:[|;&`]|%7c|%3b|%60)[^&]*/i"; http_client_body; classtype:web-application-attack; sid:9002710; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"CVE-2026-9384 Totolink A8000RU cstecgi.cgi ping/traceroute injection"; flow:to_server,established; content:"POST"; http_method; content:"/cgi-bin/cstecgi.cgi"; http_uri; pcre:"/(?:ping|traceroute|nslookup|telnetd|dropbear)[^=]*=.*(?:[|;&`]|%7c|%3b)/i"; http_client_body; classtype:web-application-attack; sid:9002711; rev:1;)

:material-file-download: prevention/snort.rules

Frequently asked questions¶

What is CVE-2026-9384?¶

CVE-2026-9384 (Totolink) is a Critical (9.8) vulnerability: Totolink A8000RU Router. This entry ships ready-to-deploy detection and prevention rules (Snort) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-9384?¶

Deploy the Snort detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-9384?¶

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

For authorized security testing and research only. See the full source and NVD record.