CVE-2026-7823: Critical Command Injection in Totolink A8000RU Routers
The National Vulnerability Database has disclosed CVE-2026-7823, a critical OS command injection vulnerability in Totolink A8000RU firmware version 7.1cu.643_b20200521. This flaw resides within the setAppFilterCfg function of the /cgi-bin/cstecgi.cgi file, where improper handling of the enable argument allows for remote command execution.
Rated with a CVSSv3.1 score of 9.8, this vulnerability is easily exploitable over the network without authentication (AV:N, AC:L, PR:N, UI:N). The exploit code is publicly available, significantly increasing the risk of widespread attacks. Attackers can leverage this to gain full control over affected devices, potentially compromising internal networks.
This isn’t just a router vulnerability; it’s a gateway into your network. Given the public exploit and ease of remote access, unpatched Totolink A8000RU devices are low-hanging fruit for any attacker. Defenders need to recognize that a compromised router can serve as a pivot point for further lateral movement, data exfiltration, or establishing persistent access within an organization.
What This Means For You
- If your organization uses Totolink A8000RU routers, immediately verify your firmware version. Any device running 7.1cu.643_b20200521 or earlier is at critical risk. Prioritize patching or replacing these devices, as public exploits mean attackers are already scanning for and exploiting this vulnerability.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-7823: Totolink A8000RU Command Injection via cgi-bin
title: CVE-2026-7823: Totolink A8000RU Command Injection via cgi-bin
id: scw-2026-05-05-ai-1
status: experimental
level: critical
description: |
Detects attempts to exploit CVE-2026-7823 by targeting the setAppFilterCfg function in Totolink A8000RU routers. The rule looks for specific URI paths and query parameters indicative of command injection attempts, such as the presence of 'setAppFilterCfg', 'enable', and command separators like '&&' or ';'.
author: SCW Feed Engine (AI-generated)
date: 2026-05-05
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-7823/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/cgi-bin/cstecgi.cgi'
cs-uri-query|contains:
- 'setAppFilterCfg'
cs-uri-query|contains:
- 'enable'
cs-uri-query|contains:
- '&&'
cs-uri-query|contains:
- ';'
condition: cs-uri AND cs-uri-query
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-7823 | Command Injection | Totolink A8000RU 7.1cu.643_b20200521 |
| CVE-2026-7823 | Command Injection | Vulnerable function: setAppFilterCfg in /cgi-bin/cstecgi.cgi |
| CVE-2026-7823 | Command Injection | Vulnerable argument: enable |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 05, 2026 at 08:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-7822 — Itsourcecode Courier Management System SQL Injection
CVE-2026-7822 — A vulnerability was identified in itsourcecode Courier Management System 1.0. This impacts an unknown function of the file /print_pdets.php. The manipulation of the...
CVE-2026-7812: Remote Command Injection in 54yyyu code-mcp MCP Tool
CVE-2026-7812 — A vulnerability was found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8. The impacted element is the function git_operation of the file src/code_mcp/server.py of the...
CVE-2026-7811: High-Severity Path Traversal in 54yyyu code-mcp
CVE-2026-7811 — A vulnerability has been found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8. The affected element is the function is_safe_path of the file src/code_mcp/server.py of...