CVE-2026-7122
OS Command Injection in Totolink A8000RU CGI Handler Enables Remote Attack
Publication date: 2026-04-27
Last updated on: 2026-04-27
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a8000ru | 7.1cu.643_b20200521 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-7122 is a command injection vulnerability found in the TOTOLINK A8000RU router, version 7.1cu.643_b20200521. It exists in the CGI Handler component, specifically in the function setUPnPCfg within the /cgi-bin/cstecgi.cgi file.
The vulnerability arises because a user-supplied parameter named "enable" is passed unchecked to a system command execution function. Attackers can craft malicious HTTP POST requests that inject arbitrary operating system commands via this parameter.
A proof of concept shows that an attacker can execute commands like listing directory contents, which confirms remote command execution without any authentication.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary operating system commands on the affected router without authentication.
Such unauthorized command execution can lead to full compromise of the device, including unauthorized access to network traffic, modification or disruption of router functionality, and potential use of the device as a foothold for further attacks within the network.
Because the exploit is publicly disclosed, attackers can easily leverage this vulnerability to cause significant security breaches.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending specially crafted HTTP POST requests to the /cgi-bin/cstecgi.cgi endpoint with the parameter "enable" containing OS commands. Successful exploitation results in execution of these commands on the device.
For example, a proof of concept uses the command `ls>./setUPnPCfg.txt` as the value of the "enable" parameter. If the device executes this command, it creates a file named setUPnPCfg.txt containing the directory listing, confirming the vulnerability.
To detect this on your network or system, you can use curl or similar tools to send the following POST request:
- curl -X POST http://[target-ip]/cgi-bin/cstecgi.cgi -d "enable=ls>./setUPnPCfg.txt"
After sending this request, check if the file setUPnPCfg.txt is created on the device or if the command output can be observed, indicating successful command injection.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-7122 vulnerability allows remote attackers to execute arbitrary operating system commands on the TOTOLINK A8000RU router without authentication. This poses a significant security risk by potentially compromising the confidentiality, integrity, and availability of data handled by the device.
Such a vulnerability could lead to unauthorized access or manipulation of sensitive data, which may result in non-compliance with common standards and regulations like GDPR and HIPAA that require protection of personal and health information.
However, the provided information does not explicitly describe the impact on compliance with these standards or any specific regulatory consequences.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-7122 vulnerability in the TOTOLINK A8000RU router, immediate steps include restricting remote access to the affected device, especially to the /cgi-bin/cstecgi.cgi endpoint, to prevent unauthorized HTTP POST requests.
Additionally, disabling or limiting UPnP functionality if not required can reduce the attack surface.
Monitoring network traffic for suspicious POST requests targeting the vulnerable function and applying firewall rules to block such attempts is also recommended.
Finally, check for and apply any available firmware updates or patches from the vendor that address this command injection vulnerability.