CVE-2026-7123
Published: 27 April 2026
Summary
CVE-2026-7123 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability identified as CVE-2026-7123 affects the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. It resides in the setIptvCfg function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component. Manipulation of the setIptvCfg argument enables OS command injection, as classified under CWE-77 and CWE-78. The issue received a CVSS 4.0 score of 8.9, reflecting network-accessible attack vectors with no required authentication or user interaction.
Remote attackers can exploit the flaw without credentials to inject and execute arbitrary operating system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected router. A public exploit has been released, increasing the practicality of attacks against exposed devices.
Reference materials point to detailed vulnerability disclosures on Vuldb and a GitHub repository containing proof-of-concept information, along with the vendor site, though no specific patch or mitigation guidance is described in the available sources. The associated EPSS score remains low, moving only from 0.0122 to a peak of 0.0125.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25839
Vulnerability details
A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument setIptvCfg results in os command injection. The attack can be initiated remotely.…
more
The exploit has been made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated OS command injection in a public-facing router CGI interface, directly enabling initial access via public-facing application exploitation (T1190) and command execution on a network device CLI/web interface (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks OS command injection by requiring validation and sanitization of the setIptvCfg argument before it reaches the CGI handler.
Enforces access-control policy on /cgi-bin/cstecgi.cgi so that unauthenticated remote callers cannot invoke setIptvCfg at all.
Limits privileges of the web-server/CGI process so that even a successful injection cannot execute arbitrary OS commands with root rights.