CVE Intelligence
Analysis AI-assisted

CVE-2026-7122: Totolink A8000RU OS Command Injection in setUPnPCfg

CVE-2026-7122 is an OS command injection vulnerability (CWE-77) in the setUPnPCfg function of the CGI Handler of the Totolink A8000RU firmware 7.1cu.643_b20200521. The CNA VulDB rates it 9.8 (Critical) under CVSS 3.1 and describes it as remotely reachable without privileges. The record states the exploit has been publicly disclosed, but no confirmed exploitation appears in the sources consulted and no fixed version is listed.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-7122 affects the Totolink A8000RU router, specifically firmware 7.1cu.643_b20200521. According to the record, the flaw is in the setUPnPCfg function, handled by the CGI Handler at /cgi-bin/cstecgi.cgi. The weakness is classified as CWE-77 (Command Injection). The record was published on 2026-04-27 by the CNA VulDB, and its source status is Deferred in the consulted data.

Impact

  • The CNA scores the issue 9.8 (Critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network reachability, no privileges and no user interaction.
  • If the vector is accurate, successful exploitation would affect confidentiality, integrity and availability of the device.
  • Command injection on a network device can allow an attacker to control the device and use it as a foothold in the local network.

Affected products and versions

  • Vendor and product: Totolink A8000RU.
  • Version named in the record: 7.1cu.643_b20200521.
  • The structured affected list in the record is empty, so other firmware builds cannot be confirmed as affected or unaffected from this data.

Exploitation status

  • The record's description states that the exploit has been disclosed to the public and may be used.
  • The record is not listed in the CISA KEV catalog.
  • No confirmed active exploitation appears in the sources consulted.

Remediation and mitigation

  • The record does not list a fixed version or a patch. The absence of fix data does not mean no fix exists; check the vendor site Totolink for firmware updates.
  • Until a verified fix is confirmed, limit exposure of the device's management and CGI interfaces, avoid exposing them to the internet, and segment the device from sensitive networks.
  • Disable UPnP on the device if it is not required, since the affected function is UPnP-related.
  • Review the VulDB entry VulDB 359721 for updates.

Detection guidance

  • Monitor logs and network traffic for unexpected requests to the cstecgi.cgi interface, especially from untrusted sources.
  • Watch for unexpected device behavior such as configuration changes, new outbound connections or service restarts.
  • Inventory all Totolink A8000RU units and their firmware versions to find devices running the named build.

Limitations of the available information

  • The record gives no fixed version, no vendor advisory and no affected version range beyond the single build named.
  • The description does not specify the exact conditions needed for exploitation beyond the stated remote vector.
  • The EPSS probability for this CVE is 0.03253 with percentile 0.88051, dated 2026-10-13. EPSS estimates are not evidence of exploitation.
  • Whether other firmware branches are affected is unknown from the sources consulted.

Frequently asked questions

What is CVE-2026-7122?

It is an OS command injection flaw (CWE-77) in the setUPnPCfg function of the CGI Handler on the Totolink A8000RU, firmware 7.1cu.643_b20200521, according to the record.

Is CVE-2026-7122 known to be actively exploited?

The record is not listed in CISA KEV and no confirmed active exploitation appears in the sources consulted, although the description says the exploit has been publicly disclosed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.