Skip to main content

Totolink A8000RU CVE-2026-7244

| EUVD-2026-26017 HIGH
Command Injection (CWE-77)
2026-04-28 cna@vuldb.com
Command Injection
8.9
CVSS 4.0
Share

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Re-analysis Queued
Apr 28, 2026 - 20:38 vuln.today
cvss_changed
Analysis Generated
Apr 28, 2026 - 09:31 vuln.today
EUVD ID Assigned
Apr 28, 2026 - 09:22 euvd
EUVD-2026-26017
Analysis Generated
Apr 28, 2026 - 09:22 vuln.today
CVE Published
Apr 28, 2026 - 09:16 nvd
HIGH 8.9

DescriptionNVD

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Remote unauthenticated command injection in Totolink A8000RU 7.1cu.643_b20200521 allows complete device compromise via crafted requests to the WiFi Guest Configuration CGI handler. Attackers can inject arbitrary OS commands through the 'merge' parameter in setWiFiEasyGuestCfg function at /cgi-bin/cstecgi.cgi, achieving full system control without authentication. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: Identify and inventory all Totolik A8000RU devices on the network, particularly edge/perimeter locations; immediately isolate or disable internet-facing instances pending remediation. Within 7 days: Contact Totolik support to confirm available firmware versions beyond 7.1cu.643_b20200521 and establish upgrade timeline; implement network-level controls (WAF rules, IP restrictions) to block CGI handler access to /cgi-bin/cstecgi.cgi if devices cannot be immediately updated. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

CVE-2026-7244 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy