CVE-2026-7121

CRITICAL

Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection

Title source: cna
STIX 2.1

Description

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument wizard causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

References (5)

Scores

CVSS v3 9.8
EPSS 0.0089
EPSS Percentile 75.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-77 CWE-78
Status published
Products (1)
Totolink/A8000RU 7.1cu.643_b20200521
Published Apr 27, 2026
Tracked Since Apr 27, 2026