Which versions of Totolink A8000RU are affected by EUVD-2026-26014?

Totolik A8000RU router firmware 7.1cu.643_b20200521 contains a critical remote command injection vulnerability that allows unauthenticated attackers to gain complete control of affected devices over…

How to fix or mitigate EUVD-2026-26014?

Within 24 hours: Identify all Totolink A8000RU devices running firmware 7.1cu.643_b20200521 using network discovery tools and isolate from production networks if possible. Within 7 days: Check Totolink support portal for firmware updates beyond 7.1cu.643_b20200521 and apply immediately to all identified devices; if no newer firmware is available, consider manufacturer end-of-life status and replacement timeline. Within 30 days: Complete replacement of all A8000RU units with alternative router platforms or deploy a network WAF to block malicious wifiOff parameter requests as interim protection.

Totolink A8000RU EUVD-2026-26014

Q: What is the CVSS score of EUVD-2026-26014?

EUVD-2026-26014 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

| CVE-2026-7241 HIGH

Command Injection (CWE-77)

2026-04-28 cna@vuldb.com

Command Injection

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:38 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 09:30 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 09:22 euvd

EUVD-2026-26014

Analysis Generated

Apr 28, 2026 - 09:22 vuln.today

CVE Published

Apr 28, 2026 - 09:16 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument wifiOff results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

Remote command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 allows unauthenticated attackers to execute arbitrary OS commands via the wifiOff parameter in setWiFiBasicCfg function. The vulnerability has a publicly available exploit (PoC on GitHub) and achieves full system compromise with network-accessible attack vector requiring no authentication or user interaction. EPSS data not available, but CVSS 8.9 (Critical) with exploitability confirmed (E:P) indicates immediate patching priority for exposed devices.

Technical ContextAI

This is a classic OS command injection vulnerability (CWE-77) in the CGI handler of a consumer WiFi router. The setWiFiBasicCfg function in /cgi-bin/cstecgi.cgi fails to sanitize the wifiOff parameter before passing it to system shell commands. CGI (Common Gateway Interface) scripts in embedded devices often use shell execution for configuration changes, and inadequate input validation allows attackers to break out of intended commands by injecting shell metacharacters (semicolons, pipes, backticks). The affected component is the router's web management interface, which processes WiFi configuration requests. Totolink A8000RU is a consumer-grade wireless router running proprietary firmware based on embedded Linux.

RemediationAI

Check Totolink vendor website (https://www.totolink.net/) for firmware updates newer than version 7.1cu.643_b20200521 that address CVE-2026-7241. No vendor-released patch version is confirmed in available data at time of analysis. If no patch is available, implement these compensating controls: (1) Disable remote administration access from WAN interfaces - restrict management interface access to LAN-only or specific trusted IP ranges via firewall rules (trade-off: remote management capability lost). (2) Place router management interface on isolated VLAN accessible only from privileged administrative workstations (requires VLAN-capable network infrastructure). (3) Deploy network-based IPS signatures to detect command injection patterns in HTTP requests to /cgi-bin/cstecgi.cgi (trade-off: potential for false positives blocking legitimate WiFi configuration changes). (4) If device is internet-facing by necessity, place behind additional firewall that terminates external connections and proxies only essential services. For full details on the vulnerability and potential indicators of compromise, reference the researcher disclosure at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_325/README.md and VulDB entries at https://vuldb.com/vuln/359848.