CVE-2026-9388

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument mode can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

• CWE-77
• CWE-78

• https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_335/README.md
• https://vuldb.com/submit/813434
• https://vuldb.com/vuln/365351
• https://vuldb.com/vuln/365351/cti
• https://www.totolink.net/

Published

May 24, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93869Cotonti through 1.0.0 contains an open redirect vulnerabilit…6.1
• CVE-2026-9387A security flaw has been discovered in Totolink A8000RU 7.1c…9.8
• CVE-2026-93870Cotonti through 1.0.0 fails to validate anti-CSRF tokens in …4.3
• CVE-2026-93871Cotonti through 1.0.0 fails to validate redirect destination…5.4
• CVE-2026-93872Cotonti 1.0.0 passes the base64-decoded cb parameter to unse…7.5
• CVE-2026-93873Cotonti through 1.0.0 fails to validate anti-CSRF tokens in …4.3
• CVE-2026-93884Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-9389A security vulnerability has been detected in Tenda F456 1.0…8.8
• CVE-2026-93894In Vinyl Cache before 9.0,2, workspace buffer overflow vulne…2.3
• CVE-2026-93897The GeoDirectory – WP Business Directory Plugin and Classifi…6.4
• CVE-2026-93899The Better Messages – Chat Rooms, Group Chat, Private Messag…6.5
• CVE-2026-9390XML::Sig versions before 0.71 for Perl allow XPath injection…9.1