CVE-2026-7242
published 2026-04-28CVE-2026-7242: A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the…
PriorityP274critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.25%
88.3th percentile
A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enabled can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| totolink | a8000ru | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.9HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vxq9-9r2j-r2jj: A vulnerability was determined in Totolink A8000RU 7
ghsa_unreviewed·2026-04-28
CVE-2026-7242 [HIGH] CWE-77 GHSA-vxq9-9r2j-r2jj: A vulnerability was determined in Totolink A8000RU 7
A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enabled can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
VulDB
Totolink A8000RU 7.1cu.643_b20200521 CGI /cgi-bin/cstecgi.cgi setOpenVpnClientCfg enabled os command injection
vuldb·2026-04-27·CVSS 8.9
CVE-2026-7242 [HIGH] Totolink A8000RU 7.1cu.643_b20200521 CGI /cgi-bin/cstecgi.cgi setOpenVpnClientCfg enabled os command injection
A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. It has been declared as critical. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enabled can lead to os command injection.
This vulnerability appears as CVE-2026-7242. The attack may be performed from remote. In addition, an exploit is available.
Red Hat
kernel: Linux kernel brcmfmac: Denial of service due to 802.1X-SHA256 authentication misconfiguration
vendor_redhat·2026-08-10·CVSS 5.3
CVE-2026-68304 [MEDIUM] CWE-617 kernel: Linux kernel brcmfmac: Denial of service due to 802.1X-SHA256 authentication misconfiguration
kernel: Linux kernel brcmfmac: Denial of service due to 802.1X-SHA256 authentication misconfiguration
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
Based on wpa_auth as 1x_256 mode, need to set up
"use_fwsup" with BRCMF_PROFILE_FWSUP_1X.
Or it will happen trace warning when call brcmf_cfg80211_set_pmk().
[ 4481.831101] ------------[ cut here ]------------
[ 4481.831102] WARNING: CPU: 1 PID: 2997 at
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:7242 brcmf_cfg80211_set_pmk+0x77/0xd0 [brcmfmac]
[...]
[ 4481.831202] Call Trace:
[ 4481.831204]
[ 4481.831205] nl80211_set_pmk+0x183/0x250 [cfg80211]
[ 4481.831233] genl_family_rcv_msg_doit+0xea/0x150
[ 4481.831237] genl_rcv_msg+0x104/0x240
[ 4481.831239] ? cfg
No detection rules found.
No public exploits indexed.
2026-04-28
Published