Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-7244: Totolink A8000RU Software Allows Unauthenticated Remote Command Execution

CVE-2026-7244 · published 6 months ago

Summary

A security flaw in the Totolink A8000RU router allows hackers to run unauthorized commands on the device, potentially giving them control over the network and its users. This can happen when a hacker sends a specific request to the router. To protect your network, update your router's firmware to the latest version as soon as possible.

Original advisory text

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

References

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

8.9 High

Exploitation

2% chance of attack within 30 days

Type

CWE-77Command Injection

CWE-78OS Command Injection

Timeline

Published28 Apr 2026

Updated30 Oct 2026

First seen28 Apr 2026

Sources

CVE-2026-7244 · NVD

Track software like this

Free during beta