vulnwire
9.8crit

CVE-2026-7204

Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection

Published 6 mo ago · modified 3 mo ago · JSON

CVSS
9.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
2.4%
percentile 84%
Public exploits
0
none known

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument enable causes os command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
yes
Technical impact
total
Assessed
6 mo ago

Exploit prediction (EPSS)

2.45% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.09.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
CNA3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
CNA2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
CNA4.08.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Totolink A8000RU

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

  • vuldb.com /vuln/359804 · vdb-entry, technical-description
  • vuldb.com /vuln/359804/cti · signature, permissions-required
  • vuldb.com /submit/801530 · third-party-advisory
  • github.com /Litengzheng/vuldb_new2/blob/main/A8000RU/vul_323/README.md · exploit
  • totolink.net / · product

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.