Cyber Resilience

CVE-2026-7122

HighRCE

Published: 27 April 2026

Published
27 April 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score v4 8.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0177 75.3th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-7122 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).

Deeper analysis

A vulnerability has been identified in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. It resides in the setUPnPCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the enable argument permits OS command injection. The issue is tracked under CVE-2026-7122 with associated CWEs 77 and 78, and carries a CVSS 4.0 score of 8.9 reflecting network-accessible attack complexity that is low and requires no user interaction or privileges.

Unauthenticated remote attackers can supply crafted input to the enable parameter and execute arbitrary operating system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected router without any authentication.

Public exploit code has been disclosed, yet the EPSS score remains low at a current value of 0.0122 with a peak of only 0.0125. No vendor advisory or patch information is provided in the available references.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. It is possible to launch the…

more

attack remotely. The exploit has been disclosed to the public and may be used.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
Why these techniques?

CVE enables unauthenticated remote OS command injection via public-facing web CGI interface on router, directly facilitating Exploit Public-Facing Application (T1190) and Network Device CLI execution (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-7123Shared CWE-77, CWE-78
CVE-2026-6114Shared CWE-77, CWE-78
CVE-2026-2082Shared CWE-77, CWE-78
CVE-2026-5997Shared CWE-77, CWE-78
CVE-2025-15254Shared CWE-77, CWE-78
CVE-2025-1819Shared CWE-77, CWE-78
CVE-2026-7243Shared CWE-77, CWE-78
CVE-2026-1506Shared CWE-77, CWE-78
CVE-2026-3696Shared CWE-77, CWE-78
CVE-2026-6154Shared CWE-77, CWE-78

Affected Assets

Totolink
A8000RU
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of the enable argument in setUPnPCfg to block OS command injection payloads before execution.

prevent

Enforces access control decisions so that unauthenticated remote callers cannot invoke the vulnerable CGI function at all.

prevent

Restricts the router to least functionality by disabling or limiting the UPnP configuration CGI endpoint that contains the injection flaw.

References