CVE-2026-7124: Totolink A8000RU OS Command Injection in setIpv6LanCfg

Overview

CVE-2026-7124 affects the setIpv6LanCfg function, served through /cgi-bin/cstecgi.cgi on the Totolink A8000RU, as listed in the CNA record from VulDB. The weakness is classified as CWE-77 (Command Injection). According to the description, manipulating the addrPrefixLen argument can lead to operating system command injection.

Impact

• The CNA scoring reports CVSS 3.1 base score 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity and availability.
• The CNA also provides a CVSS 4.0 score of 8.9 in the record.
• Successful command injection on a router would generally allow an attacker to act with the privileges of the affected service, which is an inference that the sources do not confirm in detail.

Affected products and versions

• The description identifies Totolink A8000RU 7.1cu.643_b20200521 as affected.
• The record does not contain a structured list of affected version ranges, so other firmware builds cannot be confirmed as affected or unaffected from the available data.

Exploitation status

• The record states that the exploit has been publicly disclosed and may be used.
• The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record, so no active exploitation in the wild is confirmed by the sources consulted.
• The EPSS probability in the record is 0.03253 with a percentile of 0.88042, which indicates a relatively high estimated likelihood of exploitation compared with other CVEs, but this is a statistical estimate and not confirmed exploitation.

Remediation and mitigation

• No fixed version or vendor patch is listed in the record. This is unknown, not a confirmation that no fix exists; check the vendor site and the VulDB entry for updates.
• Until a verified fix is available, reduce exposure of the device management interface: avoid exposing router administration to untrusted networks, restrict access by source address, and disable remote administration where possible.
• Inventory Totolink A8000RU devices and confirm their firmware build against the affected version named in the record.
• Consider replacing unsupported devices if the vendor does not release a fix.

Detection guidance

• Review device and network logs for unexpected requests to the CGI endpoint, particularly from external sources.
• Monitor for unusual outbound connections or configuration changes originating from the router.
• Keep the device behind a segmented network and log administrative access attempts at the perimeter.

Limitations of the available information

• The record was marked with source status Deferred and has no affected or fixed version data.
• The exact conditions required for exploitation, such as authentication state or network position, are not described beyond the remote attack vector in the CVSS data.
• The EPSS date in the record is later than the publication date, so the score should be treated with caution.
• No vendor advisory was included in the record to confirm the fix status.

Frequently asked questions

Is CVE-2026-7124 being actively exploited?

The record says a public exploit exists, but the CVE is not listed in the CISA KEV catalog in the data consulted, so no confirmed active exploitation in the wild is documented by these sources.

Which device is affected by CVE-2026-7124?

The description names the Totolink A8000RU firmware 7.1cu.643_b20200521. The record does not provide a full list of affected versions.

Is there a fixed version available?

No fixed version is listed in the record. This is unknown, so check the vendor and the VulDB entry for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.