CVE-2026-7243

Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection

View on CVE.org
Published Apr 28, 2026 CVSS 4.0 · 9.3 Critical EPSS 2.4% KEV · Not listed
Description
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument maxRtrAdvInterval leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Analysis

AI-generated

Technical impact

A vulnerability exists in the setRadvdCfg function of the /cgi-bin/cstecgi.cgi CGI handler on the Totolink A8000RU router. By sending a crafted argument maxRtrAdvInterval, an attacker can inject operating system commands, exploiting a CWE-77 Command Injection and a CWE-78 OS Command Injection weakness. This flaw allows the execution of arbitrary commands with the privileges of the web service, leading to compromise of confidentiality, integrity, and availability of the device and potentially the broader network.

Affected Systems

The affected product is the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. No other vendors or product versions are listed in the CNA data for this CVE.

Risk and Exploitability

The CVSS score 9.3 indicates a high severity risk. The EPSS score is 2%, and the vulnerability is not listed in the CISA KEV catalog, but publicly available exploits exist and may be actively used. The likely attack vector is remote, accessed via the router’s web interface; an attacker only needs to send a malicious HTTP request to the CGI endpoint to exploit the flaw.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the newest firmware update from Totolink that addresses the command injection flaw in cstecgi.cgi.
  • If an update is unavailable, restrict external access to the router’s administrative interface by placing the device behind a firewall and blocking inbound traffic to port 80/443 from untrusted networks.
  • As a temporary workaround, disable or remove access to the cstecgi.cgi endpoint by configuring the router’s access control or editing configuration files to deny the setRadvdCfg path.

Generated by OpenCVE AI on June 18, 2026 at 08:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Totolink a8000ru
Vendors & Products Totolink a8000ru
Type Values Removed Values Added
Description A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument maxRtrAdvInterval leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Title Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection
First Time appeared Totolink
Totolink a8000ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a8000ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a8000ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 28, 2026, 2:33 PM
Reserved
Apr 27, 2026, 5:22 PM

View source JSON

Updated
Apr 28, 2026, 2:07 PM

JSON

Status
Deferred
Published
Apr 28, 2026, 9:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Jun 18, 2026, 8:45 AM

JSON