CVE-2026-9475
published 2026-05-25CVE-2026-9475: A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the…
PriorityP276critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.25%
88.3th percentile
A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument Comment causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| totolink | a8000ru | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.9HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
cvelistv5v4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-25hv-9wxj-cgm5: A vulnerability was determined in Totolink A8000RU 7
ghsa_unreviewed·2026-05-26
CVE-2026-9475 [HIGH] CWE-77 GHSA-25hv-9wxj-cgm5: A vulnerability was determined in Totolink A8000RU 7
A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument Comment causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVEList
Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection
cvelistv5·2026-05-25·CVSS 9.3
CVE-2026-9475 [CRITICAL] CWE-78 Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection
Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection
A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument Comment causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Timeline: 2026-05-24: Advisory disclosed; 2026-05-24: VulDB entry created; 2026-05-24: VulDB entry last update
VulDB
Totolink A8000RU 7.1cu.643_b20200521 Web Management Interface /cgi-bin/cstecgi.cgi setIpQosRules Comment os command injection
vuldb·2026-05-24
CVE-2026-9475 [CRITICAL] Totolink A8000RU 7.1cu.643_b20200521 Web Management Interface /cgi-bin/cstecgi.cgi setIpQosRules Comment os command injection
A vulnerability classified as critical has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument Comment causes os command injection.
This vulnerability is registered as CVE-2026-9475. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
Red Hat
kernel: ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
vendor_redhat·2026-07-01
CVE-2026-53343 CWE-468 kernel: ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
kernel: ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
A flaw was found in the Linux kernel. On ARMv5 systems configured with Kernel Address Sanitizer (KASAN) for virtual memory allocated (VMAP) stack shadow, a memory access operation could attempt to read data from an unaligned memory address. This unaligned access leads to an alignment exception, causing the system to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-
No detection rules found.
No public exploits indexed.
2026-05-25
Published