CVE-2026-7243: Totolink A8000RU OS Command Injection in CGI Handler
A vulnerability in the CGI Handler component of the Totolink A8000RU, firmware 7.1cu.643_b20200521, allows OS command injection through a manipulated argument, classified as CWE-77. The CNA rates it critical with a CVSS 3.1 base score of 9.8, and the record states it can be started remotely and that a public exploit exists. No confirmed exploitation or vendor fix appears in the sources consulted.
Overview
CVE-2026-7243 is recorded as an OS command injection flaw (CWE-77) in the CGI Handler component of the Totolink A8000RU router, firmware 7.1cu.643_b20200521. The record was submitted through the VulDB CNA and states that the issue can be initiated remotely and that a public exploit is available.
Impact
The CNA reports a CVSS 3.1 base score of 9.8 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The same CNA also lists a CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10. Based on the vector, a successful attack would be inferred to cause high impact to confidentiality, integrity and availability of the device, since the attacker could run operating system commands.
Affected products and versions
- Product: Totolink A8000RU
- Affected version recorded: firmware 7.1cu.643_b20200521
- The structured affected and fixed fields in the record are empty, so no further version ranges or fixed versions can be confirmed from the available data.
Exploitation status
The KEV catalog does not list this CVE, so no active exploitation is claimed here. The record states that a public exploit is available and might be used. The EPSS probability is 0.03253 with a percentile of 0.88059, as recorded for the date 2026-10-13. No confirmed in-the-wild exploitation appears in the sources consulted.
Remediation and mitigation
- Check the vendor site at totolink.net for a firmware update or a newer supported model, and apply it when available.
- If no fix is confirmed, restrict access to the device management interface to trusted administrative networks only, and disable remote administration from untrusted networks.
- Place the device behind segmentation controls so that it is not directly reachable from the internet.
- If the device is end-of-life or cannot be patched, plan its replacement.
Detection guidance
- Review web server or CGI logs for unexpected requests to the cstecgi.cgi handler, especially from unknown or external sources.
- Watch for unexpected configuration changes, new administrative activity, or outbound connections initiated by the router.
- Forward device logs to a central system where they can be retained and correlated.
Limitations of the available information
The record has no title, no structured affected or fixed version data, and no vendor advisory beyond the vendor homepage. The source status is Deferred. The CVSS scores come from the CNA and have not been independently confirmed in the sources listed. The available data does not confirm whether the vendor has released a fix.
Frequently asked questions
Is CVE-2026-7243 known to be actively exploited?
The KEV catalog does not list this CVE, so active exploitation is not claimed. The record states a public exploit is available, but no confirmed in-the-wild exploitation appears in the sources consulted.
Which Totolink A8000RU version is affected?
The record names firmware 7.1cu.643_b20200521. The structured affected version fields are empty, so other versions cannot be confirmed from the available data.
Is there a fixed version available?
The record does not list a fixed version. This does not mean no fix exists, so check the vendor site at totolink.net for updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.