Loading vulnerability…
OS Command Injection in Totolink A8000RU setIpv6LanCfg
CVE-2026-7124 is a remote OS command injection vulnerability affecting Totolink A8000RU firmware version 7.1cu.643_b20200521. The flaw is present in the setIpv6LanCfg function exposed through /cgi-bin/cstecgi.cgi in the CGI Handler component. According to the provided content, an attacker can manipulate the addrPrefixLen argument so that attacker-controlled input is incorporated into operating system command execution, resulting in command injection on the device. The issue is remotely reachable and public exploit details have been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow a remote attacker to execute arbitrary operating system commands on the affected router. Based on the provided scoring context, the vulnerability has high impact on confidentiality, integrity, and availability, enabling compromise of device data and configuration, unauthorized modification of system state, and potential service disruption or full device takeover.
If you can’t patch tonight, do this now.
Restrict network access to the router management interface and specifically to /cgi-bin/cstecgi.cgi so it is not reachable from untrusted networks. Disable remote administration if not required, place management interfaces behind trusted internal networks or VPN-only access, and use firewall or ACL controls to limit access to administrative endpoints. Monitor for suspicious requests targeting setIpv6LanCfg or malformed addrPrefixLen values. Because public exploit disclosure exists, exposed devices should be treated as high priority for isolation or patching.
Patch, then assume compromise.
Upgrade Totolink A8000RU devices from firmware 7.1cu.643_b20200521 to a vendor-fixed release if one is available. The vulnerable CGI handler code in setIpv6LanCfg should be corrected to prevent shell metacharacter injection via the addrPrefixLen parameter, ideally by eliminating shell invocation entirely, using strict server-side input validation, and passing arguments safely to system APIs without command concatenation. If no vendor patch is available, the information currently available does not provide a confirmed fixed version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.