CVE-2026-7242: Totolink A8000RU OS Command Injection in setOpenVpnClientCfg
CVE-2026-7242 is an OS command injection weakness (CWE-77) in the setOpenVpnClientCfg function of the CGI Handler reached through /cgi-bin/cstecgi.cgi on Totolink A8000RU firmware 7.1cu.643_b20200521. The CNA scores it critical, with CVSS 3.1 at 9.8, and the record states that a public exploit has been disclosed. The CISA KEV catalog does not list it, and the record contains no fixed version.
Overview
The record describes an OS command injection weakness (CWE-77) in the setOpenVpnClientCfg function, reached through /cgi-bin/cstecgi.cgi in the CGI Handler component of Totolink A8000RU firmware 7.1cu.643_b20200521. According to the record, manipulating the enabled argument can lead to OS command injection, and the attack may be carried out remotely.
Impact
- Confirmed: the CNA's CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8, describing network-reachable, low-complexity, no-privilege, no-user-interaction attacks with high confidentiality, integrity and availability impact.
- Inference: successful command injection on a router would typically run commands with the privileges of the affected web service, which could compromise the device and the traffic it handles.
Affected products and versions
- Confirmed: the affected product is the Totolink A8000RU, firmware 7.1cu.643_b20200521, as stated in the description.
- Unknown: the record has no affected version ranges and no other firmware builds were listed.
Exploitation status
The description states that the exploit has been publicly disclosed and may be utilized. The record shows no CISA KEV listing, so no active exploitation in the wild is confirmed in the sources consulted. The EPSS data in the record reports a probability of 0.03253 and a percentile of 0.88059.
Remediation and mitigation
- The record lists no fixed version. This does not mean no fix exists, so the patch status is unknown.
- Check the vendor website Totolink for firmware updates or support statements for this model.
- Restrict access to the web management interface, disable remote administration if it is not required, and place the device behind network access controls.
- Plan replacement or isolation for devices where no vendor update is available.
Detection guidance
- Review web management and CGI access logs for unexpected requests to the cstecgi.cgi endpoint, especially from unknown sources.
- Watch for unexpected outbound connections, new processes or configuration changes on the device.
- Alert on changes to VPN client settings and keep an inventory of affected devices.
Limitations of the available information
The record has no vendor advisory, no affected or fixed version list, no NVD-assessed score (only CNA scores are present), and no SSVC data. Its source status is Deferred. The main sources are VulDB entries, and the exploit details were not reviewed or reproduced.
Frequently asked questions
What is CVE-2026-7242?
It is an OS command injection weakness (CWE-77) in the setOpenVpnClientCfg function of the CGI Handler on Totolink A8000RU firmware 7.1cu.643_b20200521, according to the record.
Is this vulnerability being actively exploited?
The record says a public exploit has been disclosed, but the CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted.
Is there a fixed version?
The record lists no fixed version. The fix status is unknown, so check the vendor website and confirm updates before relying on a patch.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.