CVE-2026-7121: Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection

Published Apr 27, 2026

Updated

A flaw has been found in Totolink A8000RU 7.1cu.643b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument wizard causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

Affected Software

1 affected component

TOTOLINK A8000RU=7.1cu.643_b20200521

Event History

Apr 27, 2026

CVE Published

via MITRE·11:45 AM

Data Sourced

via MITRE·11:45 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-7121?

CVE-2026-7121 has a high severity due to its potential for OS command injection.

How do I fix CVE-2026-7121?

Fixing CVE-2026-7121 involves updating the Totolink A8000RU firmware to a fixed version that addresses the vulnerability.

What component is affected by CVE-2026-7121?

CVE-2026-7121 affects the CGI Handler component in the Totolink A8000RU router.

Which versions of Totolink A8000RU are impacted by CVE-2026-7121?

CVE-2026-7121 specifically impacts Totolink A8000RU version 7.1cu.643_b20200521.

What is the nature of the flaw in CVE-2026-7121?

The flaw in CVE-2026-7121 allows for OS command injection through improper handling of the wizard argument in the setWizardCfg function.