A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function Vulnerability of the file /cgi-bin/cstecgi.cgi of the co…

Published:

30 april 2026 om 22:00:00

Alert date:

1 mei 2026 om 16:05:43

Source:

nvd.nist.gov

Mobile & IoT, Network Infrastructure

A remote command injection vulnerability has been identified in Totolink A8000RU router firmware version 7.1cu.643_b20200521. The vulnerability exists in the CGI Handler component, specifically in the /cgi-bin/cstecgi.cgi file where manipulation of the 'proto' argument leads to OS command injection. This security flaw can be exploited remotely by attackers. Public exploits are available for this vulnerability, making it particularly dangerous for organizations using affected devices. The vulnerability allows attackers to execute arbitrary commands on the target system through the web interface.

Technical details

Mitigation steps:

Affected products:

Totolink A8000RU