CVE-2026-7124: Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection

Published Apr 27, 2026

Updated

A vulnerability was determined in Totolink A8000RU 7.1cu.643b20200521. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument addrPrefixLen can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Affected Software

1 affected component

TOTOLINK A8000RU=7.1cu.643_b20200521

Event History

Apr 27, 2026

CVE Published

via MITRE·12:30 PM

Data Sourced

via MITRE·12:30 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-7124?

CVE-2026-7124 is considered a high severity vulnerability due to the potential for remote code execution.

How do I fix CVE-2026-7124?

To fix CVE-2026-7124, update the Totolink A8000RU firmware to the latest version that addresses this vulnerability.

What systems are affected by CVE-2026-7124?

CVE-2026-7124 affects the Totolink A8000RU running firmware version 7.1cu.643_b20200521.

What type of vulnerability is CVE-2026-7124?

CVE-2026-7124 is classified as an OS command injection vulnerability within the CGI component.

Can CVE-2026-7124 be exploited remotely?

Yes, CVE-2026-7124 can be exploited remotely by manipulating the setIpv6LanCfg function in the CGI interface.