Totolink A8000RU setDiagnosisCfg Command Injection (CVE-2026-9384)

Georg Lauenstein@gsec

•updated May 31, 2026•1•0•7

Detects exploitation attempts of CVE-2026-9384, a critical command injection vulnerability in Totolink A8000RU routers. Attackers target the 'setDiagnosisCfg' function in '/cgi-bin/cstecgi.cgi' by injecting OS commands into the 'ip' parameter.