CVE-2026-7123: Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection

Published Apr 27, 2026

Updated

A vulnerability was found in Totolink A8000RU 7.1cu.643b20200521. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument setIptvCfg results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.

Affected Software

1 affected component

TOTOLINK A8000RU=7.1cu.643_b20200521

Event History

Apr 27, 2026

CVE Published

via MITRE·12:15 PM

Data Sourced

via MITRE·12:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:16 PM

DescriptionSeverityWeakness

Oct 6, 58306

Event

via FIRST·08:43 AM

Frequently Asked Questions

What is the severity of CVE-2026-7123?

CVE-2026-7123 has been classified as a high severity vulnerability due to the potential for remote code execution through OS command injection.

How do I fix CVE-2026-7123?

To mitigate CVE-2026-7123, it is recommended to upgrade Totolink A8000RU to a patched version that addresses the command injection vulnerability.

What systems are affected by CVE-2026-7123?

CVE-2026-7123 affects the Totolink A8000RU version 7.1cu.643_b20200521 specifically.

What types of attacks can CVE-2026-7123 facilitate?

CVE-2026-7123 can facilitate attacks such as remote code execution, allowing an attacker to execute arbitrary commands on the affected system.

What are the prerequisites for exploiting CVE-2026-7123?

Exploitation of CVE-2026-7123 typically requires an attacker to have network access to the affected device and the ability to send crafted requests to the vulnerable CGI endpoint.