CVE-2026-7823: Totolink A8000RU Command Injection via setAppFilterCfg
A command injection flaw (CWE-77) has been reported in the setAppFilterCfg function of Totolink A8000RU firmware 7.1cu.643_b20200521, reachable through /cgi-bin/cstecgi.cgi. The CNA rates it critical with a CVSS 3.1 base score of 9.8 and states it can be exploited remotely. A public exploit is stated to exist, but the sources consulted show no confirmed exploitation in the wild.
Overview
The record describes an OS command injection flaw in the Totolink A8000RU, firmware 7.1cu.643_b20200521. The vulnerable function is setAppFilterCfg, reached through /cgi-bin/cstecgi.cgi, and the problem concerns how the enable argument is handled (CWE-77). The CNA states the attack can be launched remotely and that a public exploit has been released. Sources: NVD record and VulDB entry.
Impact
- Command injection on a router generally means that an attacker who can reach the vulnerable interface may be able to run operating system commands on the device. This is an inference from the weakness class, not a statement in the record.
- The CNA assigns a CVSS 3.1 base score of 9.8 (critical), with high impact on confidentiality, integrity and availability.
- The CNA also lists a CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10.
Affected products and versions
- The record names Totolink A8000RU firmware 7.1cu.643_b20200521 as the affected version.
- The affected and fixed version lists in the record are empty. Other firmware builds cannot be confirmed as affected or unaffected from the available data.
Exploitation status
- The CVE is not listed in the CISA KEV catalog in the data provided, so no confirmed active exploitation is recorded there.
- The description states that an exploit has been released publicly and may be used for attacks. Public availability of an exploit is not the same as confirmed exploitation in the wild.
- The EPSS data in the record estimates likelihood of exploitation. It does not confirm that exploitation is occurring.
Remediation and mitigation
- No vendor fix or patched version is identified in the record. Check the Totolink website for firmware updates and advisories, and apply any vendor-released update once its authenticity and applicability are verified.
- While no fix is confirmed, reduce exposure: keep management interfaces off untrusted networks, disable remote administration where possible, and restrict access to the device web interface to trusted administrators.
- Give higher priority to devices reachable from the internet or from untrusted network segments.
Detection guidance
- Review device and network logs for unusual requests to the cstecgi.cgi endpoint, especially from unexpected sources.
- Monitor for unexpected outbound connections, configuration changes or device restarts on the router.
- Apply network-level monitoring to administrative traffic directed at the device.
Limitations of the available information
- The record has no affected or fixed version lists, and the vendor advisory status is unknown.
- The source status is listed as Deferred, and exploit details are limited to a statement of public availability.
- The data does not confirm which other models or firmware builds are affected.
Frequently asked questions
What is the vulnerability in CVE-2026-7823?
The record describes an OS command injection flaw (CWE-77) in the setAppFilterCfg function of the Totolink A8000RU, firmware 7.1cu.643_b20200521, reached through /cgi-bin/cstecgi.cgi.
Is this CVE being actively exploited?
The CVE is not listed in the CISA KEV catalog in the data provided, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit has been released.
Is there a fixed version available?
The record does not list any fixed version. The absence of data does not confirm that no fix exists, so check the vendor website for updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.