CVE-2026-7240: Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection
A vulnerability has been found in Totolink A8000RU 7.1cu.643b20200521. This vulnerability affects the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument User leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7240?
CVE-2026-7240 is classified as a high severity vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2026-7240?
To fix CVE-2026-7240, update the Totolink A8000RU to a patched version that resolves this command injection issue.
What type of vulnerability is CVE-2026-7240?
CVE-2026-7240 is an OS command injection vulnerability found in the CGI handler of Totolink A8000RU.
Which component is affected by CVE-2026-7240?
CVE-2026-7240 affects the setVpnAccountCfg function within the cstecgi.cgi file of the CGI handler.
What is the impact of CVE-2026-7240?
The impact of CVE-2026-7240 allows an attacker to execute arbitrary commands on the affected device.