embedded-device-vulnerabilityinternet-facing-service-vulnerabilityinitial-access-method

Unauthenticated Command Injection Flaws Disclosed in Totolink A7100RU and A8000RU Routers

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Apr 9, 2026

Two high-severity vulnerabilities have been disclosed in Totolink routers that allow remote, unauthenticated OS command injection through the CGI handler in /cgi-bin/cstecgi.cgi. The flaws affect the A7100RU (CVE-2026-5853) running firmware 7.4cu.2313_b20191024 and the A8000RU (CVE-2026-7124) running firmware 7.1cu.643_b20200521, with both issues tied to the setIpv6LanCfg function and abuse of the addrPrefixLen argument. The vulnerabilities are mapped to CWE-78 and CWE-77 and can be exploited remotely without authentication or user interaction.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Apr 9, 2026 – Apr 27, 2026

Apr 27, 20266mo ago
CVE-2026-7124 disclosed for Totolink A8000RU command injection
A separate vulnerability entry for CVE-2026-7124 was recorded on 2026-04-27 affecting Totolink A8000RU firmware 7.1cu.643_b20200521. The issue is the same class of unauthenticated remote OS command injection in /cgi-bin/cstecgi.cgi setIpv6LanCfg through the addrPrefixLen parameter, with public exploit disclosure already reported.
Apr 9, 20267mo ago
CVE-2026-5853 disclosed for Totolink A7100RU command injection
A vulnerability entry for CVE-2026-5853 was recorded on 2026-04-09 affecting Totolink A7100RU firmware 7.4cu.2313_b20191024. The flaw in /cgi-bin/cstecgi.cgi setIpv6LanCfg allows unauthenticated remote OS command injection via the addrPrefixLen argument, and public disclosure was noted.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

OS Command Injection in Totolink A7100RU setIpv6LanCfg (CVE-2026-5853)OS Command Injection in Totolink A8000RU setIpv6LanCfg (CVE-2026-7124)

Affected products

2 linked

A8000ruA7100ru

Organizations

1 linked

Totolink

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Apr 27, 2026

CVE-2026-7124 - Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injectionOpen source ↗

Cvefeed High SeverityAdvisories · Apr 9, 2026

CVE-2026-5853 - Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injectionOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Unauthenticated Command Injection Flaws Disclosed in Totolink A7100RU and A8000RU Routers

How this story unfolded

CVE-2026-7124 disclosed for Totolink A8000RU command injection

CVE-2026-5853 disclosed for Totolink A7100RU command injection

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Unauthenticated Command Injection Flaws Disclosed in Totolink A7100RU Router

Critical Command Injection Flaws Expose Totolink A7100RU Routers to RCE

Critical Command Injection Flaws Expose Totolink A7100RU and A8000RU Routers

Unauthenticated Command Injection Flaws Disclosed in Totolink A7100RU and A8000RU Routers

How this story unfolded

CVE-2026-7124 disclosed for Totolink A8000RU command injection

CVE-2026-5853 disclosed for Totolink A7100RU command injection

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Unauthenticated Command Injection Flaws Disclosed in Totolink A7100RU Router

Critical Command Injection Flaws Expose Totolink A7100RU Routers to RCE

Critical Command Injection Flaws Expose Totolink A7100RU and A8000RU Routers