CVE-2026-7204
OS Command Injection in Totolink A8000RU CGI Handler
Publication date: 2026-04-28
Last updated on: 2026-04-28
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a8000ru | 7.1cu.643_b20200521 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-7204 is a command injection vulnerability in the TOTOLINK A8000RU router, version 7.1cu.643_b20200521. It exists in the CGI script /cgi-bin/cstecgi.cgi, specifically in the function setPptpServerCfg. The vulnerability arises because the user-supplied "enable" parameter is improperly handled and passed to a system command execution function without proper sanitization.
An attacker can remotely send a crafted request with malicious content in the "enable" parameter, which gets executed on the router's operating system. This allows arbitrary command execution without requiring authentication.
For example, a proof of concept shows that setting "enable" to a command like `ls>./setPptpServerCfg.txt` causes the router to execute the command and create a file listing the directory contents, demonstrating the exploit.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary operating system commands on the affected TOTOLINK A8000RU router without authentication.
- Attackers can gain control over the router, potentially altering its configuration or behavior.
- It can be used to disrupt network services or create backdoors for persistent access.
- Sensitive information stored or passing through the router could be exposed or manipulated.
- The overall security of the network relying on the router can be compromised.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint with the parameter "enable" set to a command that produces a detectable effect on the device.
For example, a proof of concept uses the command injection by setting "enable" to `ls>./setPptpServerCfg.txt`. This causes the router to execute the command and create a file named setPptpServerCfg.txt containing the directory listing.
You can detect the vulnerability by sending a POST request like the following and then checking if the file setPptpServerCfg.txt is created on the device:
- curl -X POST http://[router_ip]/cgi-bin/cstecgi.cgi -d "enable=ls>./setPptpServerCfg.txt"
If the file setPptpServerCfg.txt is present afterward, it confirms the device is vulnerable to command injection.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to execute arbitrary operating system commands on the affected TOTOLINK A8000RU router without authentication. This remote code execution flaw can lead to unauthorized access, data manipulation, or disruption of services.
Such unauthorized access and control over network devices can compromise the confidentiality, integrity, and availability of data processed or transmitted by the device. This may result in violations of data protection regulations and standards such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.
Therefore, exploitation of this vulnerability could negatively impact an organization's compliance posture by exposing protected data or disrupting critical systems.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-7204 vulnerability in the TOTOLINK A8000RU router, immediate steps include restricting remote access to the device's CGI interface, especially the /cgi-bin/cstecgi.cgi endpoint.
Disable or block any external access to the vulnerable function setPptpServerCfg if possible.
Monitor network traffic for suspicious POST requests containing the 'enable' parameter targeting /cgi-bin/cstecgi.cgi.
If available, apply any official patches or firmware updates from TOTOLINK addressing this vulnerability.
As a temporary measure, consider isolating the affected device from untrusted networks to prevent remote exploitation.