CVE Intelligence
Analysis AI-assisted

CVE-2026-7125: Totolink A8000RU OS Command Injection in CGI Handler

CVE-2026-7125 is an OS command injection weakness (CWE-77) in the CGI Handler of the Totolink A8000RU, firmware 7.1cu.643_b20200521. The CNA rates it critical with CVSS 3.1 9.8 and states that the attack may be initiated remotely. The record says a public exploit is available, but CISA KEV does not list the CVE and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-7125 is a command injection weakness (CWE-77) in the CGI Handler of the Totolink A8000RU router, firmware 7.1cu.643_b20200521. According to the CNA record, the flaw is in the setWiFiEasyCfg function reached through /cgi-bin/cstecgi.cgi.

Impact

  • The record associates the flaw with operating system command injection that may be initiated remotely.
  • The CNA scores the issue CVSS 3.1 9.8 (critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which denotes network reachability, no privileges or user interaction required, and high confidentiality, integrity and availability impact.
  • Other CNA scores in the record are CVSS 4.0 8.9 and CVSS 2.0 10.

Affected products and versions

  • Product: Totolink A8000RU.
  • Version listed in the record: 7.1cu.643_b20200521.
  • The affected and fixes fields in the record are empty, so no further version ranges or fixed builds are confirmed.

Exploitation status

  • The record states that the exploit is publicly available and might be used.
  • CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted.
  • The record provides an EPSS probability of 0.03253 with percentile 0.88056.

Remediation and mitigation

  • Verify whether your Totolink A8000RU devices run the listed firmware build and check the vendor site at https://www.totolink.net/ for an updated firmware. The record does not state a fixed version.
  • Restrict access to the device management interface, disable remote administration from untrusted networks, and segment the device from sensitive networks.
  • If no vendor fix is available and the device is exposed, consider replacing or retiring it.

Detection guidance

  • Review device web-interface and access logs for unexpected requests to the CGI endpoint.
  • Watch for unexpected configuration changes, especially to wireless settings, and for unusual outbound traffic from the router.

Limitations of the available information

  • The record contains no vendor advisory, no fixed version, no affected version range, and no KEV data.
  • Vendor confirmation was not found in the sources consulted, and the record status is Deferred.

Frequently asked questions

Is CVE-2026-7125 known to be actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit is available and might be used.

Which devices and versions are affected?

The record names the Totolink A8000RU with firmware 7.1cu.643_b20200521. The affected and fixes fields are empty, so other versions and fixed builds are not confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.