CVE-2026-7243
CRITICALTotolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection
Title source: cnaDescription
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument maxRtrAdvInterval leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
References (5)
Core 5
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-359850 | Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection
https://vuldb.com/vuln/359850
Signature, Permissions Required signature
permissions-required
VDB-359850 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/359850/cti
Third Party Advisory third-party-advisory
Submit #803266 | Totolink A8000RU 7.1cu.643_b20200521 Command Injection
https://vuldb.com/submit/803266
Product product
https://www.totolink.net/
Scores
CVSS v3
9.8
EPSS
0.0245
EPSS Percentile
82.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-77
CWE-78
Status
published
Products (1)
Totolink/A8000RU
7.1cu.643_b20200521
Published
Apr 28, 2026
Tracked Since
Apr 28, 2026