CVE-2026-7125: Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection

Published Apr 27, 2026

Updated

A vulnerability was identified in Totolink A8000RU 7.1cu.643b20200521. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

Affected Software

1 affected component

TOTOLINK A8000RU=7.1cu.643_b20200521

Event History

Apr 27, 2026

CVE Published

via MITRE·12:45 PM

Data Sourced

via MITRE·12:45 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:16 PM

DescriptionSeverityWeakness

Oct 6, 58306

Event

via FIRST·07:24 PM

Frequently Asked Questions

What is the severity of CVE-2026-7125?

CVE-2026-7125 is classified with a high severity level due to the potential for remote command execution.

How do I fix CVE-2026-7125?

To fix CVE-2026-7125, update the Totolink A8000RU firmware to the latest version provided by the manufacturer.

What is the impact of CVE-2026-7125 on affected devices?

The impact of CVE-2026-7125 could allow an attacker to execute arbitrary operating system commands on the affected device.

Which devices are affected by CVE-2026-7125?

CVE-2026-7125 affects the Totolink A8000RU router running firmware version 7.1cu.643_b20200521.

Is CVE-2026-7125 a hardware or software vulnerability?

CVE-2026-7125 is a software vulnerability found in the CGI Handler of the Totolink A8000RU's firmware.