CVE-2026-7121
OS Command Injection in Totolink A8000RU CGI Handler Allows Remote Exploit
Publication date: 2026-04-27
Last updated on: 2026-04-27
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a8000ru | 7.1cu.643_b20200521 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to execute arbitrary operating system commands on the affected TOTOLINK A8000RU router. This can lead to unauthorized access, data manipulation, or disruption of services.
Such unauthorized command execution can compromise the confidentiality, integrity, and availability of data processed or stored by the device, which may impact compliance with standards and regulations like GDPR and HIPAA that require protection of sensitive data and secure system operation.
Specifically, failure to prevent remote code execution vulnerabilities can lead to breaches of personal or health information, resulting in regulatory violations and potential legal consequences.
Can you explain this vulnerability to me?
CVE-2026-7121 is a command injection vulnerability found in the TOTOLINK A8000RU router, version 7.1cu.643_b20200521. It exists in the CGI Handler component, specifically in the function setWizardCfg within the /cgi-bin/cstecgi.cgi file. The vulnerability arises because a user-supplied parameter named "wizard" is improperly handled and passed to a system command execution function without proper sanitization.
An attacker can remotely send a specially crafted HTTP POST request containing malicious commands in the "wizard" parameter. This causes the router to execute arbitrary operating system commands. For example, an attacker can execute commands like listing directory contents and writing them to a file on the device, demonstrating full remote command execution capability.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary operating system commands on the affected router without any authentication. This can lead to complete compromise of the device, including unauthorized access, data theft, device manipulation, or using the device as a foothold to attack other systems on the network.
Because the exploit can be initiated remotely and without user interaction, it poses a high risk of exploitation. Attackers could disrupt network operations, steal sensitive information, or install persistent malware on the device.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a specially crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint with the parameter "wizard" containing a command to be executed on the router.
For example, a proof of concept uses the command `ls>./setWizardCfg.txt` to check if the router executes the command and creates a file named setWizardCfg.txt containing the directory listing.
You can detect the vulnerability by sending a POST request like the following and then checking if the file setWizardCfg.txt is created on the device:
- curl -X POST http://[router_ip]/cgi-bin/cstecgi.cgi -d "wizard=ls>./setWizardCfg.txt"
If the file setWizardCfg.txt appears on the device, it confirms that remote command execution is possible, indicating the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-7121 vulnerability in the TOTOLINK A8000RU router, immediate steps include restricting remote access to the affected device, especially to the /cgi-bin/cstecgi.cgi endpoint.
It is advisable to apply any available firmware updates or patches from the vendor that address this command injection flaw.
If patches are not available, consider disabling or restricting the vulnerable CGI Handler functionality or isolating the device from untrusted networks to prevent remote exploitation.
Monitoring network traffic for suspicious POST requests targeting the 'wizard' parameter can help detect exploitation attempts.