CVE Intelligence
Analysis AI-assisted

CVE-2026-7204: Totolink A8000RU cstecgi.cgi setPptpServerCfg OS Command Injection

A vulnerability in the setPptpServerCfg function of /cgi-bin/cstecgi.cgi on Totolink A8000RU firmware 7.1cu.643_b20200521 allows OS command injection through the enable argument, and the record says it can be initiated remotely. VulDB rates it critical with a CVSS 3.1 score of 9.8, and the exploit has been publicly disclosed. The record shows no CISA KEV listing, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

VulDB has published CVE-2026-7204, an OS command injection flaw (CWE-77) in the setPptpServerCfg function of the CGI handler at /cgi-bin/cstecgi.cgi on the Totolink A8000RU, firmware version 7.1cu.643_b20200521. The VulDB entry is the main technical description available.

Impact

The record states that the attack may be initiated remotely, and the CVSS 3.1 vector rates confidentiality, integrity and availability impact as high. An OS command injection weakness would normally allow an attacker to run commands on the device. That outcome is an inference from the weakness class and is not confirmed by the sources.

Affected products and versions

  • Totolink A8000RU, version 7.1cu.643_b20200521, is the only version listed in the record.
  • The record does not say whether other firmware builds are affected.
  • No fixed version is listed. The absence of a fix in the record does not prove that none exists. The vendor site is Totolink.

Exploitation status

The record shows no CISA KEV listing for this CVE. No confirmed exploitation in the wild appears in the sources consulted. The record says the exploit has been publicly disclosed and may be used, and the SSVC exploitation value is poc (proof of concept). The EPSS probability is 0.03253 with a percentile of 0.88047. EPSS estimates likelihood of exploitation and is not evidence of attacks.

Remediation and mitigation

  • Inventory all Totolink A8000RU devices and confirm their firmware version.
  • Check the vendor site for an updated firmware release and apply it once its authenticity is verified.
  • Until a fix is confirmed, restrict access to the management interface, avoid exposing the device to the internet, and place it behind a firewall or VPN.
  • Disable the PPTP server feature if it is not required to reduce the exposed attack surface.
  • If no fix is available, plan replacement or decommissioning of the device.

Detection guidance

  • Review web server and device logs for unusual requests to /cgi-bin/cstecgi.cgi from unexpected sources.
  • Monitor for unexpected configuration changes on the device and for outbound connections it initiates.
  • Alert on administrative access from new or unknown addresses.

Limitations of the available information

The record provides no fixed version, no vendor advisory and no timeline of exploitation. CVSS scores differ across CVSS versions and providers in the record, so this analysis relies on the CVSS 3.1 score from the CNA. Whether newer Totolink firmware is affected is unknown. The record contains exploit references, but this analysis does not describe exploitation steps.

Frequently asked questions

Is CVE-2026-7204 being actively exploited?

The record does not show a CISA KEV listing, and no confirmed exploitation in the wild appears in the sources consulted. The exploit has been publicly disclosed, so the risk should be treated seriously.

Which Totolink A8000RU versions are affected?

The record lists only firmware version 7.1cu.643_b20200521. Whether other builds are affected is unknown, and no fixed version is listed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.