CVE-2026-7123: Critical Command Injection in Totolink Routers Exposes Networks

The National Vulnerability Database has disclosed CVE-2026-7123, a critical command injection vulnerability affecting Totolink A8000RU routers running firmware version 7.1cu.643_b20200521. The flaw resides within the setIptvCfg function in the CGI handler (/cgi-bin/cstecgi.cgi). Attackers can remotely exploit this by manipulating the setIptvCfg argument, leading to arbitrary command execution on the affected device. The CVSS score of 9.8 highlights the severity, indicating a high potential for widespread compromise.

This vulnerability, categorized under CWE-77 and CWE-78, allows unauthenticated, remote attackers to gain full control over the router. This level of access can be leveraged to pivot into the internal network, redirect user traffic, deploy malware, or disable security features. Given the widespread use of consumer-grade routers in both home and small business environments, the attack surface is significant. The public availability of exploit details means organizations should assume active exploitation is imminent or already underway.

Defenders must prioritize patching or replacing affected Totolink A8000RU devices immediately. Network segmentation and disabling unnecessary remote management interfaces can also mitigate risk. For organizations unable to patch, a thorough review of network traffic for anomalous commands originating from or targeting the router’s management interface is crucial. This includes monitoring for unexpected outbound connections or configuration changes.