CVE-2026-7823: Totolink A8000RU RCE Vulnerability

CVE-2026-7823 Overview

CVE-2026-7823 is an operating system command injection vulnerability affecting the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The flaw resides in the setAppFilterCfg function within /cgi-bin/cstecgi.cgi, where the enable argument is passed to a shell context without sanitization [CWE-77]. An unauthenticated remote attacker can inject arbitrary shell commands by manipulating this parameter in HTTP requests to the device. The exploit has been publicly released, increasing the likelihood of opportunistic scanning and weaponization against exposed devices.

Critical Impact

Remote, unauthenticated attackers can execute arbitrary OS commands on affected Totolink A8000RU routers, leading to full device compromise and potential pivoting into internal networks.

Affected Products

• Totolink A8000RU router
• Firmware version 7.1cu.643_b20200521
• Web management interface exposed via /cgi-bin/cstecgi.cgi

Discovery Timeline

• 2026-05-05 - CVE-2026-7823 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7823

Vulnerability Analysis

The vulnerability is an OS command injection flaw in the CGI handler responsible for application filter configuration. The setAppFilterCfg handler in /cgi-bin/cstecgi.cgi reads the enable parameter from an attacker-controlled HTTP POST body and passes it to a shell interpreter without escaping or whitelisting permitted values. Because the request requires no authentication and reaches the device over the network, exploitation can be performed by any remote actor capable of reaching the router's web interface.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The firmware concatenates the enable argument directly into a system call, allowing shell metacharacters such as ;, |, &, and backticks to terminate the intended command and append attacker-supplied commands. This is a recurring weakness across Totolink CGI endpoints, where parameters are forwarded to system() style routines without input validation.

Attack Vector

Exploitation is performed remotely over the network without privileges or user interaction. An attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking setAppFilterCfg and embeds shell metacharacters in the enable field. Successful exploitation grants command execution under the privileges of the web server process, typically root on consumer routers, enabling persistence, configuration tampering, traffic interception, and lateral movement. Public proof-of-concept code is available in the GitHub PoC Repository and tracked in VulDB #361075.

Detection Methods for CVE-2026-7823

Indicators of Compromise

• HTTP POST requests to /cgi-bin/cstecgi.cgi containing the setAppFilterCfg topic and shell metacharacters (;, |, &, `, $()) inside the enable parameter.
• Outbound connections from the router to unfamiliar hosts shortly after CGI requests, indicating reverse shells or payload retrieval via wget, curl, or tftp.
• Unexpected busybox, sh, or telnetd processes spawned by the HTTP server on the device.

Detection Strategies

• Inspect web server and CGI logs for requests to cstecgi.cgi whose body contains setAppFilterCfg together with non-boolean values in enable.
• Deploy network IDS signatures that flag HTTP request bodies containing topicurl=setAppFilterCfg followed by shell metacharacters.
• Correlate router-originated DNS lookups and outbound TCP sessions with preceding administrative HTTP requests to identify post-exploitation activity.

Monitoring Recommendations

• Forward router syslog and HTTP access logs to a centralized SIEM or data lake for retention and rule-based alerting.
• Monitor for new listening ports on the WAN interface, which often signal attacker-installed backdoors.
• Track firmware checksums and configuration baselines to identify unauthorized modifications.

How to Mitigate CVE-2026-7823

Immediate Actions Required

• Restrict access to the router's web management interface to trusted internal hosts only and disable WAN-side administration.
• Audit existing devices for signs of compromise, including unknown accounts, modified DNS settings, and unauthorized port forwards.
• Replace affected Totolink A8000RU devices in high-risk environments where vendor patches are not yet available.

Patch Information

At the time of publication, no fixed firmware version is referenced in the NVD entry for CVE-2026-7823. Consult the Totolink Security Resource for vendor advisories and firmware updates, and apply any released patch for the A8000RU as soon as it becomes available.

Workarounds

• Block external access to TCP ports used by the router's HTTP and HTTPS management services at the upstream firewall.
• Disable remote management features and any unused services exposed by the device.
• Place affected routers behind a network segmentation boundary that limits which clients can reach /cgi-bin/cstecgi.cgi.