CVE Intelligence
Analysis AI-assisted

CVE-2026-7138: Totolink A8000RU OS Command Injection via setNtpCfg

CVE-2026-7138 is an OS command injection issue (CWE-77) in the setNtpCfg function of the CGI handler on Totolink A8000RU firmware 7.1cu.643_b20200521. The CNA, VulDB, rates it critical with a CVSS 3.1 score of 9.8 and reports that remote exploitation is possible and that a public exploit exists. The record lists no structured affected or fixed versions and no confirmed active exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-7138 describes an OS command injection weakness (CWE-77) in the setNtpCfg function of the /cgi-bin/cstecgi.cgi CGI handler on Totolink A8000RU firmware 7.1cu.643_b20200521. According to the record, manipulating the tz argument leads to OS command injection and the attack can be carried out remotely. The details are published by the CNA, VulDB, in its VulDB entry and mirrored in the NVD record.

Impact

  • The CNA-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) corresponds to a score of 9.8, indicating network reachability, no privileges and no user interaction required.
  • Successful command injection on an affected device would typically allow the attacker to run commands with the privileges of the web service, which could affect confidentiality, integrity and availability. This is an inference from the vector and the CWE class, not a statement from the record.
  • The record lists a separate CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10 from the same CNA.

Affected products and versions

  • Product: Totolink A8000RU, firmware version 7.1cu.643_b20200521, as named in the record.
  • The structured affected list in the record is empty, so the exact range of affected versions beyond the one named in the description is unknown.
  • No fixed version is listed. The absence of a fixed version in the record does not confirm that no fix exists.

Exploitation status

  • The record states that the exploit is now public and may be used.
  • The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation or exploitation in the wild is stated in the sources consulted.
  • The EPSS entry in the record gives a probability of 0.03253 and a percentile of 0.88047, with a date of 2026-10-13 as recorded.

Remediation and mitigation

  • The record does not provide a vendor patch or fixed firmware version. Check the Totolink website and the device support channels for firmware updates or an end-of-life notice.
  • Restrict access to the device web management interface. Do not expose it to the internet, and limit it to trusted management networks.
  • Disable remote administration features if they are not required.
  • Where no update is available, consider replacing the device or isolating it on a segment with strict egress controls.
  • Review NTP configuration on exposed devices and verify that settings have not been changed without authorization.

Detection guidance

  • Review web server and device logs for unusual requests to the cstecgi.cgi endpoint, especially from unexpected sources.
  • Monitor for configuration changes to time synchronization settings that were not made by administrators.
  • Look for unexpected outbound connections or processes originating from the device, which may indicate command execution.
  • Track the vendor and VulDB entries for updates to the record.

Limitations of the available information

  • The record has no title from the source, so the title used here is derived from the description.
  • The affected product list is empty and no fixed version is provided.
  • The scores come from the CNA only; no separate NVD or vendor assessment is included in the record.
  • The description does not include vendor advisory details, technical root cause analysis or any statement from Totolink.
  • The record lists an EPSS date later than the publication date, which should be verified against the source.

Frequently asked questions

Is CVE-2026-7138 known to be actively exploited?

The record does not list this CVE in the CISA KEV catalog and states no confirmed active exploitation in the sources consulted. It does state that a public exploit exists.

Which versions are affected?

The record names Totolink A8000RU firmware 7.1cu.643_b20200521. The structured affected list is empty, so other affected versions are unknown.

Is there a fix?

The record does not list a fixed version. Check the Totolink website and vendor support channels for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.