Attack Chain

1. An unauthenticated attacker identifies a Totolink A8000RU router running firmware version 7.1cu.643_b20200521.
2. The attacker crafts a malicious HTTP request targeting the /cgi-bin/cstecgi.cgi endpoint.
3. Within the HTTP request, the attacker injects OS commands into the command argument of the setTracerouteCfg function.
4. The web server processes the request and executes the injected OS command.
5. The attacker gains initial access to the router's operating system.
6. The attacker may then leverage this access to download and execute further malicious payloads.
7. The attacker could establish persistence by modifying system configuration files.
8. Finally, the attacker achieves complete control of the router, potentially using it as a pivot point for further network attacks, data exfiltration, or denial-of-service attacks.

Impact

Successful exploitation of this vulnerability (CVE-2026-9385) grants the attacker complete control over the affected Totolink A8000RU router. This can lead to a variety of malicious outcomes, including unauthorized access to the network, data theft, denial-of-service attacks, and the use of the compromised router as a botnet node. Given the publicly available exploit, a large number of devices are potentially at risk.

Recommendation

• Deploy the Sigma rule Detect CVE-2026-9385 Exploitation Attempt via Command Injection to identify exploitation attempts against the setTracerouteCfg function in web server logs.
• Deploy the Sigma rule Detect CVE-2026-9385 Post-Exploitation - Suspicious Process Execution to detect post-exploitation activity such as reverse shells or unauthorized software installation.
• Monitor network traffic for unusual outbound connections originating from Totolink A8000RU devices.