CVE-2026-7244
Published: 28 April 2026
Summary
CVE-2026-7244 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Remote unauthenticated attackers can supply a crafted merge parameter to the CGI endpoint and execute arbitrary operating system commands on the device. Successful exploitation grants full control over the router, including the ability to alter configuration, exfiltrate data, or pivot into attached networks, consistent with the CVSS 8.9 rating reflecting network attack vector, low complexity, and high impact on confidentiality, integrity, and availability.
Public references point to a detailed proof-of-concept and vulnerability database entries but contain no vendor advisory or firmware patch information from Totolink. The associated EPSS score remains low and essentially flat at approximately 0.012, indicating limited observed exploitation interest to date.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26017
Vulnerability details
A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge results in os command injection. It is possible…
more
to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection via public-facing web CGI on router directly enables T1190 (Exploit Public-Facing Application) for initial access and T1059.008 (Network Device CLI) for arbitrary command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validating the merge argument in setWiFiEasyGuestCfg would reject metacharacters and block OS command injection before execution.
Enforcing access on /cgi-bin/cstecgi.cgi would require authentication and authorization, denying unauthenticated remote attackers the ability to reach the vulnerable function.
Boundary protection rules could restrict external access to the router's management CGI endpoints, limiting remote exploitation of the command-injection flaw.