CVE-2026-7244 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-7244 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

A critical vulnerability has been identified in the Totolink A8000RU router (firmware version 7.1cu.643_b20200521), specifically within the setWiFiEasyGuestCfg function of the CGI handler component located at /cgi-bin/cstecgi.cgi.

Technical Detail

The flaw resides in the CGI handler's processing of input passed to the setWiFiEasyGuestCfg function, which based on the vulnerability class and CVSS score of 9.8 is consistent with a stack-based or heap-based buffer overflow or command injection condition that can be triggered remotely without authentication. An attacker with network access to the device's web management interface can send a crafted HTTP request to /cgi-bin/cstecgi.cgi to trigger the vulnerable function. Successful exploitation would likely result in unauthenticated remote code execution with the privileges of the CGI process, granting full device compromise.

Exploitation Status

No known exploit code has been publicly observed or confirmed as of May 5, 2026. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit at this time, though the critical CVSS score and the nature of the affected component make this a candidate for rapid weaponization once technical details circulate.

Who Is Targeting This

No specific threat actor attribution at this time. Vulnerabilities in consumer and small business routers from vendors such as Totolink have historically attracted attention from botnet operators targeting IoT and SOHO network devices, but no confirmed campaigns or actor activity tied to this specific CVE have been identified.

What To Do

Organizations and individuals operating the Totolink A8000RU on firmware version 7.1cu.643_b20200521 should check for an updated firmware release from Totolink and apply it immediately given the critical severity rating. If no patch is available, restrict access to the device's web management interface by disabling remote management and limiting LAN-side access to trusted hosts only. Where possible, place the device behind a network segment that limits untrusted inbound access to the CGI handler port. Monitor for anomalous HTTP POST requests targeting /cgi-bin/cstecgi.cgi with unexpected or oversized parameter values as a detection signal. Given the end-of-life status risk common to this product line, consider replacing the device if a vendor patch is not forthcoming.