CVE-2026-7124
Published: 27 April 2026
Summary
CVE-2026-7124 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-7124 is an OS command injection vulnerability in the Totolink A8000RU router running firmware 7.1cu.643_b20200521. It resides in the setIpv6LanCfg function within the /cgi-bin/cstecgi.cgi CGI handler component, where unsanitized input to the addrPrefixLen argument allows arbitrary command execution. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9.
Unauthenticated attackers can exploit the issue remotely over the network by sending a crafted HTTP request to the CGI endpoint. Successful exploitation grants the ability to execute operating-system commands with the privileges of the web server process, enabling device takeover, configuration changes, or use as a pivot point inside the local network. The public disclosure includes a working proof-of-concept.
No vendor advisory or firmware patch addressing the flaw is referenced in the available sources. The Totolink product page and the disclosure repositories do not list mitigation steps or fixed firmware versions.
The associated EPSS score remains low and essentially flat (current 0.0122, peak 0.0125), indicating limited observed exploitation activity since publication.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25841
Vulnerability details
A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument addrPrefixLen can lead to os command injection. The attack…
more
can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated OS command injection in a public-facing CGI endpoint on a router, directly enabling exploitation of public-facing applications (T1190) and execution of arbitrary commands via network device CLI abuse (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the addrPrefixLen argument in setIpv6LanCfg, blocking the unsanitized input that enables OS command injection.
Enforces access control on the /cgi-bin/cstecgi.cgi endpoint so that unauthenticated remote requests cannot reach the vulnerable function.
Limits privileges of the web-server process, reducing the impact of successful command execution even if input validation fails.