Which versions of Totolink A8000RU are affected by CVE-2026-7124?

Totolink A8000RU router firmware (version 7.1cu.643_b20200521 and potentially others) contains a critical remote command injection vulnerability that allows unauthenticated attackers to execute…

Is there a public PoC exploit available for CVE-2026-7124?

Yes, a public proof-of-concept exploit is available for CVE-2026-7124. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-7124?

Within 24 hours: Identify and isolate all Totolik A8000RU devices on the network; document firmware versions and network criticality. Within 7 days: Contact Totolink support for available firmware updates; if unavailable, determine business justification for continued operation and implement network segmentation (restrict WAN access to management interface via firewall rules, disable remote management features). Within 30 days: Replace affected devices with patched alternatives or vendors providing timely security updates; ensure replacement devices are procured with documented patch management commitments.

Totolink A8000RU CVE-2026-7124

Q: What is the CVSS score of CVE-2026-7124?

CVE-2026-7124 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-25841 HIGH

OS Command Injection (CWE-78)

2026-04-27 VulDB

Command Injection A8000Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 18:37 vuln.today

cvss_changed

PoC Detected

Apr 27, 2026 - 18:36 vuln.today

Public exploit code

Analysis Generated

Apr 27, 2026 - 13:30 vuln.today

Severity Changed

Apr 27, 2026 - 13:22 NVD

CRITICAL HIGH

CVSS changed

Apr 27, 2026 - 13:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 13:00 euvd

EUVD-2026-25841

Analysis Generated

Apr 27, 2026 - 13:00 vuln.today

CVE Published

Apr 27, 2026 - 12:30 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument addrPrefixLen can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

OS command injection in Totolink A8000RU 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via crafted addrPrefixLen parameter to the setIpv6LanCfg function in /cgi-bin/cstecgi.cgi. CVSS 8.9 (High) with CVSS:4.0 vector indicating network-accessible, low-complexity attack requiring no privileges or user interaction. Publicly available exploit code exists (GitHub POC), enabling weaponization by threat actors. Not currently listed in CISA KEV, suggesting limited observed exploitation despite public disclosure and high severity scoring.

Technical ContextAI

This vulnerability affects the CGI (Common Gateway Interface) handler component of the Totolink A8000RU wireless router firmware version 7.1cu.643_b20200521. The flaw resides in the setIpv6LanCfg function, which processes IPv6 LAN configuration parameters through the /cgi-bin/cstecgi.cgi script. The vulnerability is classified as CWE-78 (OS Command Injection), occurring when user-supplied input from the addrPrefixLen parameter is passed to system shell commands without proper sanitization or validation. This classic web application security flaw allows shell metacharacters or command separators to break out of the intended command context and execute arbitrary operating system commands with the privileges of the web server process, typically root on embedded router devices. The CGI interface represents legacy web application architecture common in consumer router firmware where form parameters are directly processed by backend scripts.

RemediationAI

No vendor-released patch or firmware update has been identified for this vulnerability at the time of analysis. The manufacturer Totolink has not published security advisories addressing CVE-2026-7124 on their official website. Organizations should implement the following compensating controls in order of effectiveness: (1) Disable remote administration access to the router's web interface, restricting CGI access to LAN-side connections only - this eliminates the AV:N attack vector but prevents remote management capabilities; (2) Disable IPv6 LAN configuration features if not operationally required - this removes the vulnerable setIpv6LanCfg function from the attack surface but eliminates IPv6 support; (3) Deploy network segmentation placing affected routers behind firewall ACLs that block external access to TCP ports 80/443 on the router management interface - this reduces exposure but does not eliminate risk from internal threats or lateral movement; (4) Replace affected devices with alternative router models from vendors with active security support programs. Monitor VulDB entries https://vuldb.com/vuln/359723 and https://vuldb.com/vuln/359723/cti for potential vendor response or community-developed patches.