CVE-2026-7244: Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection
A security flaw has been discovered in Totolink A8000RU 7.1cu.643b20200521. The impacted element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Since the flaw is an os command injection in Totolink A8000RU CGI Handler (file /cgi-bin/cstecgi.cgi) affecting function setWiFiEasyGuestCfg and the exploit is publicly available, restrict/disable remote access to the device’s CGI/management interfaces so the attack cannot be launched from the internet (e.g., allow only trusted IPs over the management interface).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7244?
CVE-2026-7244 is considered a high severity vulnerability due to its potential for remote command execution.
How do I fix CVE-2026-7244?
To fix CVE-2026-7244, update the Totolink A8000RU to the latest firmware version that addresses this vulnerability.
What type of vulnerability is CVE-2026-7244?
CVE-2026-7244 is an OS command injection vulnerability affecting the CGI handler of the Totolink A8000RU.
Which devices are affected by CVE-2026-7244?
CVE-2026-7244 specifically affects the Totolink A8000RU running version 7.1cu.643_b20200521.
What are the potential impacts of exploiting CVE-2026-7244?
Exploiting CVE-2026-7244 may allow an attacker to execute arbitrary commands on the affected device.