CVE Intelligence
Analysis AI-assisted

CVE-2026-7037: Totolink A8000RU Command Injection in setVpnPassCfg

CVE-2026-7037 is a command injection flaw (CWE-77) in the setVpnPassCfg function of the CGI Handler on the Totolink A8000RU, firmware 7.1cu.643_b20200521. The CNA VulDB reports that it can be exploited remotely and that a public exploit has been released. No confirmed active exploitation appears in the sources consulted, and the record lists no affected or fixed versions.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The CNA VulDB has published CVE-2026-7037 for the Totolink A8000RU router, firmware 7.1cu.643_b20200521. According to the record, the weakness is in the setVpnPassCfg function reached through /cgi-bin/cstecgi.cgi, in the CGI Handler component, and is classified as CWE-77 (Command Injection). The record states that the argument pptpPassThru is the vector involved. More detail is available in the VulDB entry and the vendor site.

Impact

  • The CNA's CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a network-reachable flaw with low complexity, no privileges and no user interaction.
  • If the vector is accurate, a successful attack could give high impact to confidentiality, integrity and availability of the device.
  • The CNA's base score is 9.8 under CVSS 3.1, 8.9 under CVSS 4.0 and 10 under CVSS 2.0.

Affected products and versions

  • The description names Totolink A8000RU 7.1cu.643_b20200521 as the affected product and version.
  • The structured fields for affected and fixed versions are empty in the record, so no other versions can be confirmed as affected or fixed.

Exploitation status

  • The record states that an exploit has been released to the public and may be used for attacks.
  • The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is recorded in the sources consulted.

Remediation and mitigation

  • The record does not identify a vendor fix. Check the Totolink website for firmware updates for the A8000RU and apply any released update.
  • Until a fix is confirmed, restrict access to the device's web management interface to trusted internal networks and disable remote management from the internet.
  • Place the device behind a segmented network zone and limit which hosts can reach it.
  • If no fixed firmware is available, plan to replace or retire the device.

Detection guidance

  • Review web server and CGI access logs for unexpected requests to /cgi-bin/cstecgi.cgi, especially from unknown sources.
  • Monitor the device for unexpected configuration changes, new accounts or outbound connections.
  • Use network monitoring to alert on management interface traffic from outside approved administrative hosts.

Limitations of the available information

  • The record does not list affected or fixed version ranges, vendor advisories or patch details.
  • Other firmware builds are not covered by the record, so their status is unknown.
  • The EPSS values are recorded with a date that should be verified against the current feed.
  • The sources consulted do not confirm real-world exploitation beyond the public release of the exploit.

Frequently asked questions

What is CVE-2026-7037?

It is a command injection vulnerability (CWE-77) in the setVpnPassCfg function of the CGI Handler on the Totolink A8000RU, firmware 7.1cu.643_b20200521, as described in the record.

Is this vulnerability being actively exploited?

The record does not list the CVE in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been released.

Is there a fixed version?

The record does not list any fixed version. Check the vendor website for firmware updates and treat the absence of data as unknown, not as proof that no fix exists.

What should administrators do now?

Restrict access to the management interface, disable remote administration from the internet, segment the device, monitor logs, and plan replacement if no fixed firmware is released.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.