Which versions of Totolink A8000RU are affected by EUVD-2026-26015?

CVE-2026-7242 is a critical remote code execution vulnerability in Totolink A8000RU routers (firmware 7.1cu.643_b20200521) that allows unauthenticated attackers to execute arbitrary commands and…

How to fix or mitigate EUVD-2026-26015?

Within 24 hours: Inventory all Totolik A8000RU routers in production and isolate any running firmware version 7.1cu.643_b20200521 to segregated network segments or offline status pending remediation. Within 7 days: Contact Totolink support for firmware update availability and timeline; if no patch is released, implement network access controls (WAF rules, IP restrictions to /cgi-bin/cstecgi.cgi) and monitor for exploitation attempts targeting the 'enabled' parameter in setOpenVpnClientCfg function. Within 30 days: Complete migration to patched firmware version once available, or evaluate hardware replacement if vendor support is discontinued.

Totolink A8000RU EUVD-2026-26015

Q: What is the CVSS score of EUVD-2026-26015?

EUVD-2026-26015 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

| CVE-2026-7242 HIGH

Command Injection (CWE-77)

2026-04-28 cna@vuldb.com

Command Injection

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:38 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 09:31 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 09:22 euvd

EUVD-2026-26015

Analysis Generated

Apr 28, 2026 - 09:22 vuln.today

CVE Published

Apr 28, 2026 - 09:16 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enabled can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows unauthenticated remote attackers to execute arbitrary system commands via the setOpenVpnClientCfg function in /cgi-bin/cstecgi.cgi by manipulating the 'enabled' parameter. Public exploit code exists (disclosed on GitHub), significantly lowering the barrier to exploitation. CVSS 8.9 reflects the complete compromise potential (confidentiality, integrity, availability) without requiring authentication or user interaction, making this a critical exposure for deployed devices.

Technical ContextAI

The vulnerability stems from improper neutralization of special elements used in OS commands (CWE-77). The Totolink A8000RU router's CGI handler at /cgi-bin/cstecgi.cgi processes OpenVPN client configuration requests through the setOpenVpnClientCfg function. This function fails to sanitize the 'enabled' parameter before passing it to a system command interpreter, allowing shell metacharacters to break out of the intended command context and execute arbitrary OS commands with the privileges of the web server process (typically root on embedded router firmware). This is a classic example of command injection in legacy router firmware where user-supplied input is concatenated directly into shell commands without validation or escaping.

RemediationAI

No vendor-released patch identified at time of analysis. Totolink's official website (https://www.totolink.net/) should be monitored for firmware updates addressing CVE-2026-7242, but vendor response to disclosed vulnerabilities has historically been inconsistent. Immediate compensating controls: (1) Disable remote administration access to the router's web interface - restrict management access to local network only via router's access control settings (trade-off: eliminates remote management capability); (2) Disable OpenVPN client functionality if not actively used, as the vulnerable function is specifically in the OpenVPN client configuration handler (trade-off: loss of VPN client features); (3) Place the router behind a firewall that blocks external access to TCP ports 80/443 and any custom management ports (trade-off: adds network complexity and requires additional hardware). For high-security environments, consider replacing the device with actively maintained router firmware from vendors with established security update programs, as this 2020-era firmware version suggests the device may be end-of-life. Network segmentation should isolate the router's management plane from untrusted networks.