CVE-2026-7240
Published: 28 April 2026
Description
A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument User leads to os command injection. The attack can be executed…
more
remotely. The exploit has been disclosed to the public and may be used.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by requiring validation and sanitization of the User argument in the vulnerable setVpnAccountCfg CGI function.
Requires timely remediation of the specific flaw in the Totolink A8000RU firmware, such as patching the CGI handler to eliminate the command injection vulnerability.
Enforces approved access authorizations to block unauthenticated remote access to the vulnerable /cgi-bin/cstecgi.cgi endpoint.
Security SummaryAI
CVE-2026-7240 is an OS command injection vulnerability affecting the Totolink A8000RU router on firmware version 7.1cu.643_b20200521. The flaw resides in the setVpnAccountCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where manipulation of the User argument enables command injection.
The vulnerability is remotely exploitable over the network with low complexity, requiring no privileges, user interaction, or special conditions, as indicated by its CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Any unauthenticated attacker with network access can trigger it, potentially achieving high impacts on confidentiality, integrity, and availability. It maps to CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
Advisories and additional details, including a publicly disclosed exploit, are referenced on VulDB (vuldb.com/vuln/359847) and a GitHub repository (github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_324/README.md), with the vendor site at totolink.net. The exploit has been made public and may be used in attacks.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote OS command injection in the public-facing CGI web interface of a router, directly enabling exploitation of a public-facing application (T1190).