CVE-2026-7241
Published: 28 April 2026
Summary
CVE-2026-7241 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-7241 is an OS command injection vulnerability in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. It resides in the setWiFiBasicCfg function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component, where improper handling of the wifiOff argument allows arbitrary command execution.
An unauthenticated attacker can exploit the flaw remotely over the network by sending a crafted HTTP request to the CGI endpoint. Successful exploitation grants the attacker full control over the device, enabling arbitrary OS command execution with high impact on confidentiality, integrity, and availability.
The associated EPSS score remains low at 0.0122 with a peak of only 0.0125, indicating limited observed exploitation interest since disclosure. Public proof-of-concept code has been released, and the issue is tracked under CWE-77 and CWE-78.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26014
Vulnerability details
A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument wifiOff results in os command injection. The attack is possible to…
more
be carried out remotely. The exploit has been made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection in public-facing router CGI directly enables exploitation of public-facing application (T1190) and command execution via network device CLI (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the wifiOff argument in setWiFiBasicCfg to block OS command injection payloads.
Enforces access control on the unauthenticated /cgi-bin/cstecgi.cgi endpoint so only authorized subjects can invoke setWiFiBasicCfg.
Boundary protection mechanisms (e.g., WAF rules or router ACLs) can inspect and drop crafted HTTP requests targeting the vulnerable CGI handler.