CVE Intelligence
Analysis AI-assisted

CVE-2026-7241: Totolink A8000RU OS Command Injection in setWiFiBasicCfg

A command injection weakness (CWE-77) was reported in the setWiFiBasicCfg function of the CGI Handler component on Totolink A8000RU firmware 7.1cu.643_b20200521. The CNA VulDB scores it 9.8 under CVSS 3.1 and describes remote exploitation with a public exploit, but the record lists no fixed version and the device is not in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an OS command injection issue (CWE-77) in the setWiFiBasicCfg function, reached through /cgi-bin/cstecgi.cgi, in the CGI Handler component of the Totolink A8000RU, version 7.1cu.643_b20200521. According to the description, manipulating the wifiOff argument results in OS command injection that can be carried out remotely.

Impact

  • The CNA VulDB base score is 9.8 under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which corresponds to high confidentiality, integrity and availability impact if exploited.
  • Other CVSS scores in the record are 8.9 under version 4.0 and 10 under version 2.0, all from the same CNA.
  • Successful command injection on a router-class device would generally allow an attacker to act with the privileges of the vulnerable service, which is an inference and not stated by the sources.

Affected products and versions

  • The record identifies Totolink A8000RU 7.1cu.643_b20200521 as the affected version in the description.
  • The structured affected-products field is empty, so other firmware builds cannot be confirmed as affected or unaffected from this record.
  • No fixed version is listed in the record.

Exploitation status

  • The record states that the exploit has been made public and could be used.
  • The CVE is not listed in CISA KEV in the record, and no confirmed active exploitation appears in the sources consulted.
  • The FIRST EPSS probability is 0.03253 (percentile 0.88042) as recorded.

Remediation and mitigation

  • Check the vendor site for a firmware update that addresses this issue; the record does not identify one.
  • Until a fix is confirmed, restrict access to the device management interface, avoid exposing it to the internet, and place it behind network segmentation or a firewall.
  • Inventory all Totolink A8000RU devices and confirm their firmware build against the affected version in the description.
  • If the device cannot be patched or isolated, consider replacing it with a supported model.

Detection guidance

  • Review web management and CGI request logs for unusual requests to cstecgi.cgi, particularly those touching Wi-Fi configuration parameters.
  • Monitor the device for unexpected configuration changes, new processes or outbound connections.
  • Correlate alerts at the network perimeter with traffic toward management interfaces of routers.

Limitations of the available information

  • The record contains no fixed version, no vendor advisory content and no structured affected-version list.
  • The vendor status of this issue is unknown from the record.
  • The EPSS date in the record (2026-10-13) is later than the publication date, so the score should be re-checked against the current data.
  • Details about the exploit and its reach are limited to the description text.

Frequently asked questions

Is CVE-2026-7241 being actively exploited?

The record is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been released and could be used.

Which devices are affected?

The description names Totolink A8000RU firmware 7.1cu.643_b20200521. The structured affected-products list is empty, so other builds cannot be confirmed from this record.

Is there a fixed version?

No fixed version is listed in the record. Check the vendor website for updates, and treat the patch status as unknown until confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.