CVE-2026-7243
Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection
- State
- Published
- Severity
- 9.3 Critical
- Published
- Apr 28, 2026
- Updated
- Apr 28, 2026
- Reserved
- Apr 27, 2026
Description
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument maxRtrAdvInterval leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 3.0 | 9.8 Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 2.0 | 10.0 High | AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
A8000RUTotolink |
|
References
- VDB-359850 | Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injectionvdb-entrytechnical-description
- VDB-359850 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #803266 | Totolink A8000RU 7.1cu.643_b20200521 Command Injectionthird-party-advisory
- https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_327/README.mdexploit
- https://www.totolink.net/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.