CVE Intelligence
Analysis AI-assisted

CVE-2026-7137: Totolink A8000RU OS Command Injection in setStorageCfg

Totolink A8000RU build 7.1cu.643_b20200521 contains an OS command injection flaw in the setStorageCfg function, triggered through the sambaEnabled argument. The CNA rates it critical with CVSS 3.1 score 9.8, states that remote exploitation is possible, and notes that a public exploit has been disclosed. The record identifies no vendor fix and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A command injection weakness (CWE-77) was reported in the CGI Handler of the Totolink A8000RU, build 7.1cu.643_b20200521. The issue involves the setStorageCfg function reached through /cgi-bin/cstecgi.cgi, where the sambaEnabled argument is not handled safely. The information comes from the CNA VulDB, and further details are tracked in the VulDB entry and on the Totolink website.

Impact

  • The CNA rates the issue critical with CVSS 3.1 score 9.8 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning network access, no privileges and no user interaction.
  • Successful command injection would generally let commands run on the underlying operating system with the privileges of the affected service. Actual consequences depend on device configuration and are not documented in the record.
  • The CNA rates confidentiality, integrity and availability impact as high.

Affected products and versions

  • Product: Totolink A8000RU.
  • Version named in the description: 7.1cu.643_b20200521.
  • The structured affected and fixed-version fields in the record are empty. Other builds are neither confirmed as affected nor confirmed as unaffected.

Exploitation status

  • The CNA states that an exploit has been publicly disclosed and may be used.
  • The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog in the record, so no active exploitation is recorded there.
  • No confirmed exploitation in the wild appears in the sources consulted. The record gives an EPSS probability of 0.03253 and a percentile of 0.88056.

Remediation and mitigation

  • The record identifies no vendor fix or patched build. Check the Totolink website for firmware updates for the A8000RU and apply them once they are verified.
  • Until a fix is confirmed, limit access to the device management interface to trusted administrative networks and keep it away from the internet.
  • Disable functions that are not required, and review whether the Samba-related storage features are needed on deployed devices.
  • Plan replacement or isolation for devices that remain unpatched and no longer receive support.

Detection guidance

  • Review web server and device logs for requests to the CGI handler path that carry unexpected characters or unusual values in storage configuration parameters.
  • Monitor for unexpected outbound connections or new processes associated with the router or access device.
  • Keep configuration backups and compare current settings against a known-good baseline to spot unauthorized changes.

Limitations of the available information

  • The record does not provide affected version ranges, fixed versions, vendor advisory text or proof of fix status.
  • Technical exploitation details are intentionally omitted. The CNA states a public exploit exists, but its reliability and scope were not verified in the sources consulted.
  • The EPSS date in the record (2026-10-13) is later than the publication date (2026-04-27) and should be checked against the source before reliance.

Frequently asked questions

Is CVE-2026-7137 being actively exploited?

The record does not list CVE-2026-7137 in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The CNA does state that a public exploit has been disclosed, so the risk of exploitation should be treated seriously.

Which Totolink A8000RU versions are affected?

The record names build 7.1cu.643_b20200521. The structured affected and fixed-version fields are empty, so other builds cannot be confirmed either way.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.