Cyber Posture

CVE-2026-7121

Critical

Published: 27 April 2026

Published
27 April 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0125 79.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument wizard causes os command injection. It is possible to initiate the attack…

more

remotely. The exploit has been published and may be used.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents OS command injection by requiring validation of the untrusted 'wizard' argument passed to the setWizardCfg function in the CGI handler.

SI-2 Flaw Remediation good match
prevent

Mandates timely flaw remediation through firmware patching to eliminate the specific command injection vulnerability in the Totolink A8000RU router.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Facilitates proactive detection of the command injection vulnerability via vulnerability scanning, enabling remediation before remote exploitation.

Security SummaryAI

CVE-2026-7121 is an OS command injection vulnerability affecting the Totolink A8000RU router on firmware version 7.1cu.643_b20200521. The issue exists in the setWizardCfg function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component, where manipulation of the "wizard" argument triggers command injection.

Attackers can exploit this vulnerability remotely without authentication or user interaction, as reflected in its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation enables arbitrary OS command execution, resulting in high impacts to confidentiality, integrity, and availability, potentially leading to full device compromise.

An exploit has been published on GitHub at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_306/README.md, with further details documented on VulDB (https://vuldb.com/vuln/359720 and https://vuldb.com/submit/800933) and the vendor site at https://www.totolink.net/. Practitioners should consult these resources for mitigation guidance or patches.

Details

CWE(s)
CWE-77CWE-78

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

CVE enables unauthenticated remote exploitation of a public-facing web application (router CGI) for arbitrary OS command injection on a likely Unix-based system.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References