CVE-2026-7125 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-7125 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-7125 is a critical vulnerability in the Totolink A8000RU router (firmware version 7.1cu.643_b20200521), specifically within the setWiFiEasyCfg function of the CGI handler component located at /cgi-bin/cstecgi.cgi.

Technical Detail

The flaw resides in improper input handling within the setWiFiEasyCfg function, which processes user-supplied parameters through the device's CGI interface. An attacker can manipulate input passed to this function to trigger what is likely a stack-based or command injection vulnerability, a pattern consistent with similar Totolink CGI handler findings on this firmware line. Successful exploitation could result in unauthenticated remote code execution (RCE) on the affected device, granting full control of the router at the operating system level. The CVSS score of 9.8 indicates the vulnerability is network-exploitable, requires no authentication, and demands no user interaction.

Exploitation Status

As of May 4, 2026, no known public exploit code has been confirmed for this vulnerability, and it does not appear on CISA's Known Exploited Vulnerabilities (KEV) catalog. The exploit maturity is currently assessed as no known exploit. This status should be monitored closely, as similar Totolink CGI handler vulnerabilities have historically attracted rapid proof-of-concept development from the research community.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. No campaigns or targeted sectors have been associated with this CVE in available intelligence. Totolink devices have previously been incorporated into botnets by opportunistic actors, but no such activity has been linked to this specific vulnerability.

What To Do

Organizations and individuals operating the Totolink A8000RU on firmware version 7.1cu.643_b20200521 should check the Totolink vendor portal for an updated firmware release and apply it immediately given the critical severity rating. If no patch is available, restrict access to the device's CGI management interface by disabling remote administration and placing the device behind a network access control boundary that limits exposure to trusted hosts only. As a detection signal, monitor for anomalous HTTP POST requests to /cgi-bin/cstecgi.cgi containing unexpected or oversized parameter values. Given the 9.8 CVSS score and the network-accessible, unauthenticated attack vector, this should be treated as a high-priority remediation item even in the absence of confirmed active exploitation.