CVE-2026-7823
Published: 05 May 2026
Description
A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setAppFilterCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable results in os command injection. The attack may be launched remotely. The exploit has been…
more
released to the public and may be used for attacks.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the OS command injection flaw in the setAppFilterCfg function by identifying, reporting, and correcting the vulnerability through patching or code fixes.
Prevents command injection by requiring sanitization and validation of the untrusted 'enable' argument prior to processing in the cgi-bin script.
Enforces approved authorizations to block unauthenticated remote access to the vulnerable /cgi-bin/cstecgi.cgi endpoint, preventing exploitation.
Security SummaryAI
CVE-2026-7823 is an OS command injection vulnerability (CWE-77, CWE-78) in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The flaw resides in the setAppFilterCfg function within the /cgi-bin/cstecgi.cgi script, where manipulation of the "enable" argument allows arbitrary command execution. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical.
The vulnerability is exploitable remotely by unauthenticated attackers with network access, requiring low complexity and no user interaction. Successful exploitation grants attackers high-impact control over confidentiality, integrity, and availability, potentially enabling full router compromise, such as executing arbitrary system commands.
Advisories from VulDB detail the issue and reference a public exploit in a GitHub repository at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_330/README.md, along with CTI tracking. The vendor's site at https://www.totolink.net/ is listed, but no specific patches or mitigations are detailed in the provided references.
The exploit has been publicly released, increasing the risk of real-world attacks against unpatched Totolink A8000RU devices.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public router web CGI directly enables remote exploitation of a public-facing application (T1190) resulting in arbitrary Unix shell command execution (T1059.004).