CVE Intelligence
Analysis AI-assisted

CVE-2026-7123: Totolink A8000RU OS Command Injection in CGI Handler

CVE-2026-7123 is an OS command injection flaw (CWE-77) in the CGI Handler component of the Totolink A8000RU, firmware 7.1cu.643_b20200521, reported as remotely exploitable. The CNA scores it CVSS 3.1 9.8 (critical), and the record states that a public exploit exists. The CISA KEV catalog does not list it, and no vendor fix is identified in the record.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-7123 is classified as CWE-77 (command injection) and affects the Totolink A8000RU router, firmware 7.1cu.643_b20200521. According to the record, manipulating an argument of a function in the CGI Handler component leads to OS command injection and can be initiated remotely. The record states that the exploit has been made public.

Impact

  • Successful exploitation could allow an attacker to run operating system commands on the device. The exact privileges obtained are unknown (inference).
  • The CNA vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H rates confidentiality, integrity and availability impact as high. The CNA also lists CVSS 4.0 8.9 and CVSS 2.0 10.

Affected products and versions

  • Totolink A8000RU, firmware 7.1cu.643_b20200521, as stated in the record.
  • The record contains no structured list of affected or fixed versions. Other versions are unknown.

Exploitation status

The record states that the exploit has been made public and could be used. The CVE is not listed in the CISA KEV catalog, so no active exploitation in the wild is documented in the sources consulted.

Remediation and mitigation

  • The record identifies no vendor fix. Check the Totolink website for firmware updates and apply any update that addresses this issue once its scope is verified.
  • Until a fix is confirmed, do not expose the device management interface to the internet, restrict administrative access to trusted hosts, and segment the device from untrusted networks.
  • If the IPTV configuration feature is not used, consider disabling it.

Detection guidance

  • Review device and web management logs for requests to CGI endpoints from unexpected sources.
  • Watch for unexpected configuration changes or unusual outbound connections from the router.

Limitations of the available information

  • The record contains no vendor advisory, no fixed version and no structured affected version list.
  • The public exploit is referenced by third-party entries, which were not analyzed for this content.
  • Details of the exploit mechanics are intentionally omitted.

Frequently asked questions

Is CVE-2026-7123 known to be actively exploited?

The record says a public exploit exists, but this CVE is not listed in the CISA KEV catalog. No active exploitation in the wild is documented in the sources consulted.

Is there a fixed version for this vulnerability?

The record does not identify a fixed version or vendor advisory. Check the Totolink website for updates and treat the status as unknown until confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.