CVE Intelligence
Analysis AI-assisted

CVE-2026-7202: Totolink A8000RU OS command injection in setWiFiWpsStart CGI handler

A vulnerability in the setWiFiWpsStart function of the CGI Handler component in Totolink A8000RU firmware 7.1cu.643_b20200521 allows OS command injection through the wscDisabled argument, according to the record. The CNA rates it critical with a CVSS 3.1 base score of 9.8, and the record states the attack can be initiated remotely. The record also states that the exploit has been publicly disclosed, but the CISA KEV catalog does not list this CVE.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-7202 describes an OS command injection weakness (CWE-77) in the setWiFiWpsStart function, reached through /cgi-bin/cstecgi.cgi in the CGI Handler component of Totolink A8000RU firmware 7.1cu.643_b20200521. The record was submitted by the CNA cna@vuldb.com, and related tracking is available in the VulDB entry.

Impact

  • The record states that manipulation of the wscDisabled argument leads to OS command injection, which could allow an attacker to run operating system commands on the affected device.
  • The record states the attack can be initiated remotely.
  • The CNA provides a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Other scores listed are CVSS 4.0 at 8.9 and CVSS 2.0 at 10, both from the CNA.
  • Consequences beyond those stated in the record are not confirmed.

Affected products and versions

  • Product named in the record: Totolink A8000RU, version 7.1cu.643_b20200521.
  • The affected-products field in the record is empty, so other affected versions are unknown.
  • Vendor reference: Totolink.

Exploitation status

  • The record states that the exploit has been disclosed to the public and may be used.
  • The CISA KEV catalog does not list this CVE, so no active exploitation is confirmed through KEV. No confirmed exploitation in the wild appears in the sources consulted.
  • EPSS values in the record are a probability of 0.03253 and a percentile of 0.88044.

Remediation and mitigation

  • The record does not list a fixed version. A missing fix entry does not mean no fix exists; its availability is unknown.
  • Inventory all Totolink A8000RU devices and confirm their firmware version against the affected version named in the record.
  • Check the vendor site for firmware updates and apply any vendor-issued fix once verified.
  • Restrict access to device management interfaces to trusted administrative networks and disable remote management where it is not required.
  • If no update is available, consider isolating or replacing the device, and treat exposed units as high priority.

Detection guidance

  • Review web and CGI access logs on the device, or on upstream proxies, for unusual requests to /cgi-bin/cstecgi.cgi, particularly those related to Wi-Fi WPS configuration.
  • Monitor for unexpected outbound connections or unfamiliar processes on the device where telemetry is available.
  • These are high-level indicators only. The record does not provide signatures or validated indicators of compromise.

Limitations of the available information

  • The affected and fixed version fields in the record are empty.
  • The vendor's own advisory is not part of the record; the technical description comes from the CNA.
  • The record status is Deferred, and the record does not explain what that status means.
  • The record does not explain the EPSS date value.
  • The record does not include the title, so the title used here is derived from the description.

Frequently asked questions

What is CVE-2026-7202?

It is a record describing OS command injection in the setWiFiWpsStart function of the CGI Handler in Totolink A8000RU firmware 7.1cu.643_b20200521, triggered through the wscDisabled argument.

Is this CVE known to be actively exploited?

The CISA KEV catalog does not list it, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that the exploit has been publicly disclosed.

Is there a fixed version?

The record does not list a fixed version. Whether a fix exists is unknown, so check the vendor for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.