CVE-2026-9478
published 2026-05-25CVE-2026-9478: A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the…
PriorityP275critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.25%
88.3th percentile
A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| totolink | a8000ru | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.9HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
cvelistv5v4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-prcq-7777-rj56: A weakness has been identified in Totolink A8000RU 7
ghsa_unreviewed·2026-05-26
CVE-2026-9478 [HIGH] CWE-77 GHSA-prcq-7777-rj56: A weakness has been identified in Totolink A8000RU 7
A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
CVEList
Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection
cvelistv5·2026-05-25·CVSS 9.3
CVE-2026-9478 [CRITICAL] CWE-78 Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection
Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection
A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Timeline: 2026-05-24: Advisory disclosed; 2026-05-24: VulDB entry created; 2026-05-24: VulDB entry last update
VulDB
Totolink A8000RU 7.1cu.643_b20200521 Web Management Interface /cgi-bin/cstecgi.cgi setParentalRules enable os command injection
vuldb·2026-05-24
CVE-2026-9478 [CRITICAL] Totolink A8000RU 7.1cu.643_b20200521 Web Management Interface /cgi-bin/cstecgi.cgi setParentalRules enable os command injection
A vulnerability, which was classified as critical, was found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection.
This vulnerability appears as CVE-2026-9478. The attack may be performed from remote. In addition, an exploit is available.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-9478 qt5-qtwebengine: Use after free in ANGLE [fedora-42]
bugzilla·2025-09-01·CVSS 8.8
CVE-2025-9478 [HIGH] CVE-2025-9478 qt5-qtwebengine: Use after free in ANGLE [fedora-42]
CVE-2025-9478 qt5-qtwebengine: Use after free in ANGLE [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases
Bugzilla
CVE-2025-9478 chromium-browser: angle: Use after free in ANGLE
bugzilla·2025-08-26·CVSS 8.8
CVE-2025-9478 [HIGH] CVE-2025-9478 chromium-browser: angle: Use after free in ANGLE
CVE-2025-9478 chromium-browser: angle: Use after free in ANGLE
Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2026:74084 https://access.redhat.com/errata/RHSA-2026:74084
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:69098 https://access.redhat.com/errata/RHSA-2026:69098
2026-05-25
Published