CVE-2026-9386

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument lang leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.

• CWE-77
• CWE-78

• https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_333/README.md
• https://vuldb.com/submit/813432
• https://vuldb.com/vuln/365349
• https://vuldb.com/vuln/365349/cti
• https://www.totolink.net/

Published

May 24, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93853Unverified ownership in Barman snapshot backup deletion allo…7.2
• CVE-2026-93854In OpenStack Blazar before 17.0.1, the V2 lease API does not…7.2
• CVE-2026-93855The SendPress Newsletters plugin for WordPress is vulnerable…7.5
• CVE-2026-93856In OpenStack Cinder through 29.0.0, cross-project informatio…4.3
• CVE-2026-93857A stack-based buffer overflow vulnerability in Fireware OS's…9.2
• CVE-2026-93858In OpenStack Mistral through 23.0.0, the std.ssh_proxied act…8.7
• CVE-2026-93860In OpenStack Mistral through 23.0.0, the /v2/maintenance API…7.1
• CVE-2026-93861In OpenStack Mistral through 23.0.0, the workflow membership…6
• CVE-2026-93862An out-of-bounds read vulnerability in the FireCluster Sync …7.2
• CVE-2026-93864A link following vulnerability in WatchGuard Fireware OS’s f…7.1
• CVE-2026-93865A missing authentication vulnerability in the Fireware OS Fi…9.2
• CVE-2026-93866An integer overflow vulnerability in the WebSocket connectio…9.2