Loading vulnerability…
OS Command Injection in Totolink A8000RU setUPnPCfg
CVE-2026-7122 is a remote OS command injection vulnerability affecting Totolink A8000RU firmware version 7.1cu.643_b20200521. The flaw is in the setUPnPCfg function exposed through the /cgi-bin/cstecgi.cgi CGI handler. According to the provided content, improper handling of the enable argument allows attacker-controlled input to be used in a way that results in execution of operating system commands. The issue is reachable remotely over the network, and public exploit details have been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow a remote attacker to execute arbitrary OS commands on the affected router. Based on the provided CVSS vectors, the impact is high across confidentiality, integrity, and availability, implying potential full compromise of the device, unauthorized configuration changes, access to sensitive information processed by the router, service disruption, and use of the device as a foothold for further network activity.
If you can’t patch tonight, do this now.
Until a fixed firmware release is available, restrict network access to the /cgi-bin/cstecgi.cgi management interface to trusted administrative hosts only, disable remote administration if not required, place the device management plane behind internal-only access controls, and monitor for suspicious requests targeting setUPnPCfg or the enable parameter. If operationally feasible, disable exposed UPnP-related configuration interfaces and isolate affected devices from untrusted networks. Given public exploit disclosure, prioritize patching or replacement of exposed devices.
Patch, then assume compromise.
Upgrade Totolink A8000RU firmware to a vendor-fixed release if one is available. Because the provided content identifies the vulnerable version as 7.1cu.643_b20200521 but does not specify a patched version, the exact fixed version is currently not available from the supplied data. If source-level remediation is relevant, the vulnerable setUPnPCfg handling of the enable parameter should be corrected by eliminating shell invocation with untrusted input, using strict allowlisting for accepted values, and ensuring input is not passed to command interpreters.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.