CVE-2026-7136: Totolink A8000RU OS Command Injection in setDmzCfg

Overview

CVE-2026-7136 was published on 2026-04-27 and describes a command injection weakness in the setDmzCfg function, reached through /cgi-bin/cstecgi.cgi, in Totolink A8000RU firmware 7.1cu.643_b20200521. The record classifies the issue as CWE-77 (Command Injection). The entry was submitted through VulDB, which acts as the CNA. See the VulDB entry and the NVD record.

Impact

According to the record, a manipulated wanIdx argument can lead to operating system command injection. The CVSS 3.1 vector in the record indicates network access, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. Scores from other CVSS versions supplied by the same CNA are 8.9 under 4.0 and 10 under 2.0. The practical impact depends on how the device is deployed and exposed.

Affected products and versions

• Product named in the record: Totolink A8000RU.
• Version named in the record: 7.1cu.643_b20200521.
• The structured affected-products field in the record is empty, so the full affected range is not established.
• Vendor information: Totolink.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. The description states that the exploit has been made available to the public and could be used for attacks. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. The EPSS value in the record is 0.03253 with a percentile of 0.88056, which is an estimate of exploitation likelihood and not a confirmation of activity.

Remediation and mitigation

• Check the vendor site for a firmware update that addresses this issue. The record lists no fixed version, which does not mean no fix exists.
• Do not expose the device administration interface to the internet. Restrict access to trusted management networks only.
• Review whether DMZ or port-forwarding features are needed. Disable them if they are not required.
• If no vendor fix is available, plan for replacing the device with a supported model, or isolate it behind additional network controls.

Detection guidance

• Inventory Totolink A8000RU devices and record their firmware versions.
• Review web and CGI access logs for unexpected requests to cstecgi.cgi from unknown sources.
• Where device logging is available, look for configuration changes or unexpected system activity around the time of suspicious requests.
• Monitor network boundaries for inbound management traffic reaching the device from outside trusted networks.

Limitations of the available information

• The record does not provide a fixed version or a complete list of affected versions.
• The vendor advisory is not among the sources provided, so vendor confirmation is missing.
• The record's source status is Deferred, which suggests the analysis may be incomplete.
• The CVSS scores come from the CNA and have not been independently verified here.
• The EPSS date in the record is not consistent with the publication date and should be verified against the source.

Frequently asked questions

Is CVE-2026-7136 being actively exploited?

The CISA KEV catalog does not list this CVE in the record, and no confirmed active exploitation appears in the sources consulted. The description does state that a public exploit is available.

Which devices are affected?

The record names Totolink A8000RU firmware 7.1cu.643_b20200521. The full affected range is not listed, so check the vendor site and your inventory.

Is there a fixed version?

The record lists no fixed version. Check the vendor for a firmware update, and restrict administrative access in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.