CVE-2026-7243
Published: 28 April 2026
Summary
CVE-2026-7243 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
A vulnerability identified as CVE-2026-7243 affects the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. It resides in the setRadvdCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the maxRtrAdvInterval argument enables operating system command injection. The issue is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9, reflecting network-accessible exploitation without authentication or user interaction.
An unauthenticated remote attacker can supply crafted input to the affected parameter and execute arbitrary operating system commands on the device. Publicly available exploit code increases the feasibility of such attacks, which could lead to full compromise of the router's confidentiality, integrity, and availability.
The EPSS score remains low, with a current value of 0.0122 and a peak of 0.0125, indicating limited observed exploitation interest to date. Vendor references point to the Totolink support site without detailing specific patches or mitigations in the available information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26016
Vulnerability details
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument maxRtrAdvInterval leads to os command injection. It is possible to initiate…
more
the attack remotely. The exploit is publicly available and might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote unauthenticated OS command injection in a public-facing web CGI interface on a router (network device), directly enabling exploitation of public-facing applications (T1190) and command execution on network device CLI/shell (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted input such as the maxRtrAdvInterval argument before it reaches the OS command interpreter in setRadvdCfg.
Enforces access-control decisions on the CGI handler so that unauthenticated remote callers cannot invoke setRadvdCfg at all.
Enables monitoring of CGI and system-call activity to identify anomalous command execution stemming from crafted maxRtrAdvInterval values.