CVE-2026-7121: Totolink A8000RU Command Injection via CGI Handler setWizardCfg
A flaw classified as OS command injection (CWE-77) has been reported in the CGI Handler of the Totolink A8000RU, firmware 7.1cu.643_b20200521, in the setWizardCfg function. The CNA (VulDB) scores it 9.8 under CVSS 3.1 and states that it can be initiated remotely and that a published exploit may be used. CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted.
Overview
VulDB published record CVE-2026-7121 describing an OS command injection weakness in the CGI Handler of the Totolink A8000RU router, firmware 7.1cu.643_b20200521. The issue lies in the setWizardCfg function reached through /cgi-bin/cstecgi.cgi and is classified as CWE-77. The details are summarized in the VulDB entry and the NVD record.
Impact
- The CNA score uses the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which corresponds to a network-reachable issue with low complexity, no privileges and no user interaction, and high impact on confidentiality, integrity and availability. The base score is 9.8.
- Command injection in a device management interface can allow code or commands to run on the device. This consequence is an inference from the weakness class and is not confirmed by the sources.
Affected products and versions
- The record identifies Totolink A8000RU firmware 7.1cu.643_b20200521.
- The record contains no structured list of affected or fixed versions, so the status of other firmware builds and hardware revisions is unknown.
Exploitation status
- The CNA states that an exploit has been published and may be used. A published exploit is not the same as confirmed exploitation in the wild.
- CISA KEV does not list this CVE. No confirmed active exploitation appears in the sources consulted.
Remediation and mitigation
- The record does not identify a vendor fix. Check the Totolink website for firmware updates for the A8000RU and apply any official build that addresses this issue once its contents are verified.
- Until a fix is confirmed, reduce exposure: limit access to the web management interface to trusted internal networks, disable remote administration from the WAN side, and keep the device behind a filtering perimeter.
- If the model is no longer supported by the vendor, plan its replacement.
Detection guidance
- Review web server and CGI access logs for unexpected requests to cstecgi.cgi, especially from external addresses or at unusual times.
- Monitor routers for unexpected configuration changes, new administrative accounts, or outbound connections initiated by the device.
- Maintain an inventory of A8000RU units with their firmware builds to prioritize response.
Limitations of the available information
- The source status is Deferred, and the record lacks affected version ranges, fixed versions and KEV details.
- The EPSS probability of 0.03253 (percentile 0.8805) is a statistical estimate and is not evidence of exploitation.
- The EPSS date in the record (2026-10-13) is later than the publication date (2026-04-27), so this value should be verified before use.
- The scores come from a single provider, the CNA VulDB, and no independent CNA or vendor assessment is present.
Frequently asked questions
Is CVE-2026-7121 being actively exploited?
CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted. The CNA does state that a published exploit may be used, which is a separate fact.
Which devices are affected?
The record identifies Totolink A8000RU firmware 7.1cu.643_b20200521. Other firmware builds and hardware revisions are unknown from the available data.
What should administrators do now?
Check the vendor for an official firmware update, limit access to the web management interface to trusted networks, and disable remote administration from the WAN side until a fix is verified.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.