CVE-2026-7125
Published: 27 April 2026
Description
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge leads to os command injection. The attack may be…
more
initiated remotely. The exploit is publicly available and might be used.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by requiring validation of the untrusted 'merge' argument in the vulnerable setWiFiEasyCfg CGI function.
Mandates timely remediation of the specific firmware flaw enabling command injection through patching or updates.
Facilitates identification of the CVE-2026-7125 vulnerability via monitoring and scanning, enabling proactive flaw remediation.
Security SummaryAI
CVE-2026-7125 is an OS command injection vulnerability affecting the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The issue resides in the setWiFiEasyCfg function within the /cgi-bin/cstecgi.cgi component of the CGI Handler, where manipulation of the "merge" argument enables arbitrary command execution. Classified under CWE-77 and CWE-78, it carries a CVSS v3.1 base score of 9.8, reflecting its critical severity due to network accessibility, low attack complexity, and lack of prerequisites.
The vulnerability can be exploited remotely by unauthenticated attackers with no privileges required, no user interaction needed, and low complexity, allowing initiation over the network. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially enabling full router compromise such as data theft, persistent access, or further network pivoting. A public exploit is available, increasing the risk of widespread abuse.
Advisories documented on VulDB (including vuln/359724 and related CTI/submit pages) detail the vulnerability and its discovery, while a GitHub repository provides exploit code in a README.md file. The Totolink vendor website is referenced, though specific patch details are not outlined in available information. Security practitioners should monitor for firmware updates and apply network segmentation to affected devices.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection via public-facing router web CGI enables exploitation of public-facing application (T1190) and Unix shell command execution (T1059.004).