Loading vulnerability…
OS Command Injection in Totolink A8000RU setWizardCfg
CVE-2026-7121 is an OS command injection vulnerability affecting Totolink A8000RU firmware version 7.1cu.643_b20200521. The flaw is present in the setWizardCfg function exposed through /cgi-bin/cstecgi.cgi in the device's CGI Handler. According to the provided content, improper handling of the wizard argument allows attacker-controlled input to be incorporated into operating system command execution, resulting in remote command injection.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow a remote attacker to execute arbitrary operating system commands on the affected device. Based on the provided severity context and CVSS vectors, this can lead to full compromise of the router, including loss of confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If patching is not immediately possible, restrict network access to the router's management/CGI interface, especially from untrusted networks and the internet; disable remote administration if enabled; place the management plane behind trusted internal networks only; use firewall rules or ACLs to limit access to /cgi-bin/cstecgi.cgi; and monitor for exploitation attempts targeting the setWizardCfg functionality. Given that a public exploit is reported as available, exposure reduction should be treated as urgent.
Patch, then assume compromise.
Upgrade to a vendor-fixed firmware version if one is available from Totolink. Because the provided content identifies a specific affected firmware build but does not specify a patched version, the exact fixed release is currently not available. Review vendor advisories and replace or retire the affected firmware if no security update is provided.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.