CVE-2026-7121
Published: 27 April 2026
Summary
CVE-2026-7121 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by requiring validation of the untrusted 'wizard' argument passed to the setWizardCfg function in the CGI handler.
Mandates timely flaw remediation through firmware patching to eliminate the specific command injection vulnerability in the Totolink A8000RU router.
Facilitates proactive detection of the command injection vulnerability via vulnerability scanning, enabling remediation before remote exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables unauthenticated remote exploitation of a public-facing web application (router CGI) for arbitrary OS command injection on a likely Unix-based system.
NVD Description
A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument wizard causes os command injection. It is possible to initiate the attack…
more
remotely. The exploit has been published and may be used.
Deeper analysisAI
CVE-2026-7121 is an OS command injection vulnerability affecting the Totolink A8000RU router on firmware version 7.1cu.643_b20200521. The issue exists in the setWizardCfg function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component, where manipulation of the "wizard" argument triggers command injection.
Attackers can exploit this vulnerability remotely without authentication or user interaction, as reflected in its CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation enables arbitrary OS command execution, resulting in high impacts to confidentiality, integrity, and availability, potentially leading to full device compromise.
An exploit has been published on GitHub at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_306/README.md, with further details documented on VulDB (https://vuldb.com/vuln/359720 and https://vuldb.com/submit/800933) and the vendor site at https://www.totolink.net/. Practitioners should consult these resources for mitigation guidance or patches.
Details
- CWE(s)