CVE-2026-7244: Totolink A8000RU OS Command Injection in setWiFiEasyGuestCfg
A command injection flaw (CWE-77) has been reported in the setWiFiEasyGuestCfg function of the CGI handler on Totolink A8000RU firmware 7.1cu.643_b20200521. According to the record, manipulation of the merge argument can lead to operating system command execution, and the attack can be launched remotely. The description states a public exploit exists, but the record does not show KEV listing or confirmed exploitation.
Overview
VulDB, acting as CNA, published CVE-2026-7244 describing an OS command injection issue in the setWiFiEasyGuestCfg function reached through /cgi-bin/cstecgi.cgi on the Totolink A8000RU, firmware 7.1cu.643_b20200521. The weakness is classified as CWE-77 (Command Injection). The record's status is Deferred, so further analysis by NVD may follow.
Impact
- The CNA rates the issue Critical with CVSS 3.1 score 9.8 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network attack, low complexity, no privileges and no user interaction.
- The same CNA also lists a CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10.
- Command injection generally allows an attacker to run operating system commands on the device. This is an inference from the CWE classification, not a confirmed outcome for this device.
Affected products and versions
- Confirmed in the record: Totolink A8000RU, firmware 7.1cu.643_b20200521.
- The structured affected list in the record is empty, so other firmware builds can neither be confirmed nor excluded.
- Vendor website: Totolink.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog. The description states that an exploit has been publicly released and may be used for attacks. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability in the record is 0.03253 (percentile 0.88049), which estimates the likelihood of exploitation activity but does not confirm attacks.
Remediation and mitigation
- The record contains no fixed version or vendor patch information. This is unknown, and it does not mean that no fix exists.
- Check the Totolink website for firmware updates for the A8000RU and apply any official update.
- Restrict access to the device management interface to trusted administrative networks, and do not expose it to the internet.
- Segment router and IoT management traffic from sensitive internal networks.
- Disable remote management features that are not required.
- If no vendor fix is confirmed, treat the device as at risk and plan isolation or replacement.
Detection guidance
- Review web server and device logs for requests to the cstecgi.cgi endpoint from unexpected sources.
- Monitor for unexpected changes to guest Wi-Fi configuration and for unfamiliar processes on the device where logging allows.
- Alert on outbound connections from the device to unfamiliar hosts, which may indicate post-compromise activity.
Limitations of the available information
- The record includes no affected version range beyond the single firmware string, no patched version and no vendor advisory text.
- The CVSS scores come from the CNA. The record contains no separate NVD score.
- The public exploit claim comes from the description and was not independently verified here.
- Exploit mechanics are intentionally omitted from this analysis.
Frequently asked questions
Is CVE-2026-7244 being actively exploited?
The record does not list this CVE in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The description does state that a public exploit has been released.
Is there a patch for the Totolink A8000RU flaw?
The record contains no fixed version or vendor patch information. That is unknown rather than proof that no fix exists, so check the vendor website for firmware updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.