Critical Command Injection Flaws Expose Totolink A8000RU Routers to Remote RCE

Three critical vulnerabilities, CVE-2026-7121, CVE-2026-7122, and CVE-2026-7125, were disclosed in the Totolink A8000RU router running firmware 7.1cu.643_b20200521, all affecting the /cgi-bin/cstecgi.cgi CGI handler. The flaws are OS command injection issues in the setWizardCfg, setUPnPCfg, and setWiFiEasyCfg functions, where crafted input to the wizard, enable, and merge arguments can trigger command execution on the device. The vulnerabilities are mapped to CWE-78 and CWE-77 and were rated critical across CVSS v2, CVSS v3.1, and CVSS v4.0 scoring schemes.

All three issues are remotely exploitable over the network and require no privileges and no user interaction, creating a high-risk exposure for internet-accessible devices. Public exploit information has already been disclosed, with references including VulDB entries and a GitHub proof-of-concept, increasing the likelihood of near-term exploitation. The disclosures indicate that multiple administrative configuration paths in the router's web interface can be abused for remote code execution, making unpatched A8000RU systems a priority for immediate review and remediation.