Description
A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enabled can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Published: 2026-04-28
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote OS Command Execution
Action: Immediate Patch
AI Analysis

Impact

The flaw resides in the setOpenVpnClientCfg function of /cgi-bin/cstecgi.cgi in Totolink A8000RU firmware 7.1cu.643_b20200521. The vulnerability allows an attacker to inject arbitrary operating‑system commands via manipulation of the enabled argument. Exploitation results in remote execution of shell commands, effectively compromising the device’s confidentiality, integrity and availability. The weakness is characterized by CWE‑77 (OS Command Injection) and CWE‑78 (OS Command Injection).

Affected Systems

Affected vendor is Totolink; product is the A8000RU router running version 7.1cu.643_b20200521 of its firmware. Any device using this model and firmware revision is susceptible. Additional hardware models or firmware revisions that do not patch this function are not identified in the current data.

Risk and Exploitability

The CVSS v3 score of 9.3 marks this as Critical. EPSS data is not available; however, the public disclosure and the availability of a functional exploit increase the realistic probability of attack. The KEV catalog does not list this CVE, but the disclosed vulnerability and active exploit code suggest a high risk of real‑world exploitation. Attackers can perform the exploit remotely through the router’s web interface without requiring local access.

Generated by OpenCVE AI on April 28, 2026 at 19:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the router firmware to the latest official release that removes the insecure setOpenVpnClientCfg entry.
  • If a firmware update is not immediately available, disable the OpenVPN client configuration capability via the router’s web interface or by removing the enabled option from the cstecgi.cgi configuration, and block access to /cgi-bin/cstecgi.cgi using firewall rules.
  • Configure the router’s firewall or access‑control lists to limit web‑interface access to trusted local network IPs only, and consider disabling remote administration until the issue is patched.

Generated by OpenCVE AI on April 28, 2026 at 19:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 28 Apr 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a8000ru
Vendors & Products Totolink a8000ru

Tue, 28 Apr 2026 09:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enabled can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Title Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection
First Time appeared Totolink
Totolink a8000ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a8000ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a8000ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A8000ru A8000ru Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-28T12:32:05.027Z

Reserved: 2026-04-27T17:22:49.171Z

Link: CVE-2026-7242

cve-icon Vulnrichment

Updated: 2026-04-28T12:31:57.446Z

cve-icon NVD

Status : Deferred

Published: 2026-04-28T09:16:17.627

Modified: 2026-04-28T20:24:20.377

Link: CVE-2026-7242

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T19:30:27Z

Weaknesses