Description
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument maxRtrAdvInterval leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Published: 2026-04-28
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote OS Command Injection
Action: Immediate Patch
AI Analysis

Impact

A vulnerability exists in the setRadvdCfg function of the /cgi-bin/cstecgi.cgi CGI handler on the Totolink A8000RU router. By sending a crafted argument maxRtrAdvInterval, an attacker can inject operating system commands. This flaw allows the execution of arbitrary commands with the privileges of the web service, leading to compromise of confidentiality, integrity, and availability of the device and potentially the broader network.

Affected Systems

The affected product is the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. No other vendors or product versions are listed in the CNA data for this CVE.

Risk and Exploitability

The CVSS score of 9.3 indicates a high severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but publicly available exploits exist and may be actively used. The likely attack vector is remote, accessed via the router’s web interface; an attacker only needs to send a malicious HTTP request to the CGI endpoint to exploit the flaw.

Generated by OpenCVE AI on April 28, 2026 at 19:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the newest firmware update from Totolink that addresses the command injection flaw in cstecgi.cgi.
  • If an update is unavailable, restrict external access to the router’s administrative interface by placing the device behind a firewall and blocking inbound traffic to port 80/443 from untrusted networks.
  • As a temporary workaround, disable or remove access to the cstecgi.cgi endpoint by configuring the router’s access control or editing configuration files to deny the setRadvdCfg path.

Generated by OpenCVE AI on April 28, 2026 at 19:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 28 Apr 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a8000ru
Vendors & Products Totolink a8000ru

Tue, 28 Apr 2026 09:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument maxRtrAdvInterval leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Title Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection
First Time appeared Totolink
Totolink a8000ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a8000ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a8000ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A8000ru A8000ru Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-28T14:33:36.080Z

Reserved: 2026-04-27T17:22:52.543Z

Link: CVE-2026-7243

cve-icon Vulnrichment

Updated: 2026-04-28T14:07:24.953Z

cve-icon NVD

Status : Deferred

Published: 2026-04-28T09:16:17.787

Modified: 2026-04-28T20:24:20.377

Link: CVE-2026-7243

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T19:30:27Z

Weaknesses