Loading vulnerability…
OS Command Injection in Totolink A8000RU setVpnPassCfg
CVE-2026-7037 is a remote OS command injection vulnerability affecting Totolink A8000RU firmware version 7.1cu.643_b20200521. The flaw is present in the setVpnPassCfg function exposed through the /cgi-bin/cstecgi.cgi CGI handler. According to the provided content, improper handling of the pptpPassThru argument allows attacker-controlled input to be used in a way that results in operating system command injection. The issue is remotely exploitable, and public exploit code has been released.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow a remote attacker to execute arbitrary operating system commands on the affected device. Given the provided severity context and vectors, this can plausibly result in full compromise of the router, including unauthorized access to configuration and sensitive data, modification of device state, disruption of network services, and establishment of persistence or further pivoting from the device.
If you can’t patch tonight, do this now.
Restrict network access to the router's administrative and CGI interfaces, especially from untrusted networks and the public Internet. Disable remote administration if not strictly required. Place the management interface behind trusted network boundaries, ACLs, or VPN-only access. Monitor for suspicious requests targeting /cgi-bin/cstecgi.cgi and specifically parameters associated with VPN configuration such as pptpPassThru. Because public exploit code is reportedly available, exposure reduction should be treated as urgent until patched firmware is deployed.
Patch, then assume compromise.
Upgrade to a vendor-fixed firmware release if one is available from Totolink. If no patched version is currently available in the provided information, the affected firmware version 7.1cu.643_b20200521 should be considered vulnerable and replaced or upgraded as soon as a fix is published. Review vendor advisories and release notes for corrected firmware addressing the setVpnPassCfg handling in /cgi-bin/cstecgi.cgi.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.