A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the com…

Published:

27 april 2026 om 22:00:00

Alert date:

28 april 2026 om 10:02:18

Source:

nvd.nist.gov

Mobile & IoT, Network Infrastructure

A remote OS command injection vulnerability was discovered in Totolink A8000RU router firmware version 7.1cu.643_b20200521. The vulnerability affects the setOpenVpnClientCfg function in the CGI handler component, specifically in the /cgi-bin/cstecgi.cgi file. Attackers can exploit this by manipulating the 'enabled' argument to inject OS commands. The vulnerability can be exploited remotely and proof-of-concept exploits have been publicly disclosed, making it actively exploitable.

Technical details

Mitigation steps:

Affected products:

Totolink A8000RU