Summary
generated automatically from NVD dataTotolink A8000RU firmware version 7.1cu.643_b20200521 contains an OS command injection flaw in the setIpv6LanCfg function of /cgi-bin/cstecgi.cgi, part of the CGI Handler component. Manipulating the addrPrefixLen argument allows a remote attacker to inject operating system commands, and the description notes that an exploit has been publicly disclosed. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.8 and is classified as CWE-77.
NVD description
A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument addrPrefixLen can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
EPSS · FIRST.org
3.3%probability of exploitation in the next 30 days
Higher than 88% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 27 avr. 2026
- Updated
- 17 juin 2026
- Status
- Deferred
- Source
- cna@vuldb.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-77
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.