CVE-2026-7202
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk83th percentile - higher than 83% of all known CVEs
Summary
A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi. Manipulation of the argument wscDisabled leads to OS command injection. The attack can be initiated remotely. The exploit has been disclosed to the public.
Risk Assessment
Risk includes remote takeover of the router, leading to network traffic interception and further attacks within the local network.
Recommendation
Update the router firmware to the latest available version or consider replacing the device if no patch is provided.
Original NVD description (English source)
A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument wscDisabled leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.