CVE-2026-7203: Totolink A8000RU OS Command Injection in setUrlFilterRules CGI Handler
A vulnerability in the setUrlFilterRules function of the CGI Handler on Totolink A8000RU firmware 7.1cu.643_b20200521 allows OS command injection through the enable argument. The record describes it as remotely triggerable, rated critical with CVSS 3.1 score 9.8 by the CNA, and classified as CWE-77. The sources consulted report a public exploit but no confirmed exploitation in the wild, and no fixed version is listed.
Overview
The record describes an OS command injection flaw (CWE-77) in the setUrlFilterRules function, reached through /cgi-bin/cstecgi.cgi in the CGI Handler component of the Totolink A8000RU. The description names firmware 7.1cu.643_b20200521 as the affected build. The CNA is VulDB.
Impact
- The CNA's CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which corresponds to a remotely reachable, low-complexity issue with no privileges or user interaction required and high impact on confidentiality, integrity and availability.
- A command injection flaw in a router management interface can allow an attacker to run operating system commands on the device if exploited.
- Other CVSS versions listed by the CNA are 4.0 (score 8.9) and 2.0 (score 10).
Affected products and versions
- The record's structured affected list is empty. The only version information comes from the description: Totolink A8000RU 7.1cu.643_b20200521.
- Whether other firmware builds or hardware revisions are affected is unknown from the sources consulted.
Exploitation status
- The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is recorded there.
- The description states that the exploit has been made public and could be used. No confirmed exploitation in the wild appears in the sources consulted.
- The EPSS record gives a probability of 0.03253 and a percentile of 0.88043.
Remediation and mitigation
- No fixed version or vendor patch is listed in the record. Check the vendor site for firmware updates for your model and apply any released update.
- Until a verified fix is available, limit access to the device's web management interface. Restrict it to trusted administrative networks and do not expose it to the internet.
- Review whether the device's management interface is reachable from untrusted networks, and remove unnecessary exposure.
- If a vendor fix is not available, consider replacing the device or isolating it according to your organization's risk policy.
Detection guidance
- Review web server and CGI access logs for unexpected requests to /cgi-bin/cstecgi.cgi, especially from unknown sources.
- Monitor the device for unexpected configuration changes, new accounts, or outbound connections from the router.
- Keep an inventory of Totolink A8000RU devices and their firmware builds to prioritize review.
Limitations of the available information
- The record has no title, no vendor-confirmed affected version range, no fixed version, and no patch reference beyond the vendor homepage.
- The NVD source status is Deferred, so the NVD analysis may be incomplete.
- The public exploit is mentioned, but no exploit details are provided here, and this analysis does not describe how to exploit the flaw.
Frequently asked questions
What is CVE-2026-7203?
It is an OS command injection vulnerability in the setUrlFilterRules function of the CGI Handler on the Totolink A8000RU, according to the record. It is classified as CWE-77.
Is this CVE being actively exploited?
The CISA KEV catalog does not list it in this record, and no confirmed exploitation in the wild appears in the sources consulted. The description says a public exploit exists.
Is there a fixed version?
No. The record lists no fixed version or patch. Check the vendor website for firmware updates and restrict access to the management interface until a fix is verified.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.