CVE-2026-7203
OS Command Injection in Totolink A8000RU CGI Handler (Remote
Publication date: 2026-04-28
Last updated on: 2026-04-28
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a8000ru | 7.1cu.643_b20200521 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-7203 is a command injection vulnerability in the TOTOLINK A8000RU router, version 7.1cu.643_b20200521. It exists in the CGI script /cgi-bin/cstecgi.cgi, specifically in the function setUrlFilterRules. The vulnerability arises because a user-supplied parameter named "enable" is passed unsafely to a system command execution function.
An attacker can send a crafted HTTP POST request to the vulnerable CGI endpoint with malicious content in the "enable" parameter. This causes the router to execute arbitrary operating system commands remotely, without any authentication.
A proof of concept shows that by setting "enable" to a command like `ls>./setUrlFilterRules.txt`, the router executes the command and creates a file containing the directory listing, confirming the exploit.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary operating system commands on the affected router without any authentication.
- Attackers can take full control of the device, potentially altering its configuration or using it as a foothold into the internal network.
- Sensitive information stored or passing through the router could be exposed or manipulated.
- The device could be used to launch further attacks, such as denial of service or spreading malware.
- Because the exploit is publicly available, the risk of exploitation is high.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint with the parameter "enable" containing a command to verify command execution.
For example, a proof of concept uses the command `ls>./setUrlFilterRules.txt` as the value of the "enable" parameter. If the router is vulnerable, it will execute this command and create a file named setUrlFilterRules.txt containing the directory listing.
A detection command example using curl would be:
- curl -X POST -d "enable=ls>./setUrlFilterRules.txt" http://[router_ip]/cgi-bin/cstecgi.cgi
After sending this request, check the router's file system for the presence of setUrlFilterRules.txt to confirm exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to execute arbitrary operating system commands on the affected TOTOLINK A8000RU router. This could lead to unauthorized access, data manipulation, or disruption of services.
Such unauthorized access and potential data breaches could impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and ensure system integrity.
However, the provided information does not explicitly describe the direct impact on compliance with these standards.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-7203 vulnerability in the TOTOLINK A8000RU router, immediate steps include restricting or blocking remote access to the /cgi-bin/cstecgi.cgi endpoint to prevent exploitation of the command injection flaw.
Additionally, it is advisable to monitor network traffic for suspicious POST requests targeting the vulnerable function and to apply any available firmware updates or patches from the vendor that address this issue.
If no patch is available, consider disabling the CGI Handler component or the setUrlFilterRules functionality temporarily to reduce attack surface.