Description
A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enabled can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Published: 2026-04-28
Score: 9.3 Critical
EPSS: 2.5% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in the setOpenVpnClientCfg function of /cgi-bin/cstecgi.cgi in Totolink A8000RU firmware 7.1cu.643_b20200521. The vulnerability allows an attacker to inject arbitrary operating system commands via manipulation of the enabled argument. Exploitation results in remote execution of shell commands, effectively compromising the device’s confidentiality, integrity and availability. The weakness is characterized by CWE-77 (OS Command Injection) and CWE-78 (OS Command Injection).

Affected Systems

Affected vendor is Totolink; product is the A8000RU router running version 7.1cu.643_b20200521 of its firmware. Any device using this model and firmware revision is susceptible. Additional hardware models or firmware revisions that do not patch this function are not identified in the current data.

Risk and Exploitability

The CVSS v3 score of 9.3 marks this as Critical. An EPSS score of 2% indicates a moderate likelihood that the vulnerability will be exploited, and the publicly disclosed exploit code further increases the realistic probability. The KEV catalog does not list this CVE, but the active exploit code and moderate EPSS score suggest a high risk of real‑world exploitation. Attackers can perform the exploit remotely through the router’s web interface without requiring local access.

Generated by OpenCVE AI on June 18, 2026 at 08:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the router firmware to the latest official release that removes the insecure setOpenVpnClientCfg entry.
  • If a firmware update is not immediately available, disable the OpenVPN client configuration capability via the router’s web interface or by removing the enabled option from the cstecgi.cgi configuration, and block access to /cgi-bin/cstecgi.cgi using firewall rules.
  • Configure the router’s firewall or access‑control lists to limit web‑interface access to trusted local network IPs only, and consider disabling remote administration until the issue is patched.

Generated by OpenCVE AI on June 18, 2026 at 08:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 28 Apr 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a8000ru
Vendors & Products Totolink a8000ru

Tue, 28 Apr 2026 09:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enabled can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Title Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection
First Time appeared Totolink
Totolink a8000ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a8000ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a8000ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A8000ru A8000ru Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-28T12:32:05.027Z

Reserved: 2026-04-27T17:22:49.171Z

Link: CVE-2026-7242

cve-icon Vulnrichment

Updated: 2026-04-28T12:31:57.446Z

cve-icon NVD

Status : Deferred

Published: 2026-04-28T09:16:17.627

Modified: 2026-06-17T11:02:04.083

Link: CVE-2026-7242

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T08:45:03Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')