A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-bin/cstecgi.cgi of the …

Published:

26 april 2026 om 22:00:00

Alert date:

27 april 2026 om 19:18:12

Source:

nvd.nist.gov

Mobile & IoT, Network Infrastructure

A critical vulnerability (CVE-2026-7138) was discovered in Totolink A8000RU router firmware version 7.1cu.643_b20200521. The vulnerability affects the setNtpCfg function in the CGI handler component, specifically in the /cgi-bin/cstecgi.cgi file. The flaw allows remote attackers to perform OS command injection by manipulating the 'tz' parameter. This vulnerability can be exploited remotely and public exploits are now available, making it a high-priority security concern for affected router deployments.

Technical details

Mitigation steps:

Affected products:

Totolink A8000RU