CVE-2026-7123 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-7123 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-7123 is a critical-severity vulnerability in the Totolink A8000RU router (firmware version 7.1cu.643_b20200521), specifically affecting the setIptvCfg function within the CGI handler at /cgi-bin/cstecgi.cgi.

Technical Detail

The flaw resides in improper input handling within the setIptvCfg function of the device's CGI interface, where manipulation of a parameter passed to the handler can trigger undefined or exploitable behavior, consistent with a stack-based or command injection class vulnerability commonly found in this device family. An attacker able to reach the CGI endpoint can craft a malicious request to exploit this flaw, potentially achieving unauthenticated remote code execution on the underlying Linux-based firmware. Given the CVSS score of 9.8, the attack vector is assessed as network-accessible with no authentication required and no user interaction needed.

Exploitation Status

No known exploit code has been publicly observed or confirmed as of May 4, 2026. This vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit at this time, though the vulnerability class and device exposure profile make it a candidate for future weaponization.

Who Is Targeting This

No specific threat actor attribution at this time. Totolink router vulnerabilities have historically been incorporated into botnet campaigns targeting SOHO and consumer networking equipment, but no confirmed actor activity has been linked to this specific CVE.

What To Do

Organizations and individuals operating the Totolink A8000RU on firmware version 7.1cu.643_b20200521 should check Totolink's official support channels for a patched firmware release and apply it immediately upon availability. In the interim, restrict access to the device's web management interface by disabling remote administration and ensuring the CGI endpoint is not exposed to untrusted networks or the public internet. Network-level controls such as firewall rules blocking inbound access to port 80 and 443 on the device from external sources should be applied as a compensating control. Given the network-accessible, unauthenticated nature of this flaw, exposure on internet-facing segments should be treated as high priority for remediation.