CVE Intelligence
Analysis AI-assisted

CVE-2026-7139: TOTOLINK A8000RU OS Command Injection in setWiFiAclRules CGI Handler

CVE-2026-7139 is a command injection flaw in the setWiFiAclRules function of the CGI Handler in TOTOLINK A8000RU firmware 7.1cu.643_b20200521, reachable remotely through /cgi-bin/cstecgi.cgi. The CNA scores it 9.8 under CVSS 3.1, and the record states that an exploit has been published. The record lists no fixed version, and the device is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-7139 affects the setWiFiAclRules function exposed through the CGI Handler component at /cgi-bin/cstecgi.cgi on TOTOLINK A8000RU firmware 7.1cu.643_b20200521. According to the record, manipulating the mode argument leads to operating system command injection (CWE-77). The record was submitted through VulDB and is also listed by NVD.

Impact

  • The record classifies the issue as OS command injection, which can allow an attacker to run commands on the underlying device if the input is not properly validated.
  • The CNA rates the CVSS 3.1 base score at 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack, no privileges and no user interaction.
  • The CNA also lists CVSS 4.0 at 8.9 and CVSS 2.0 at 10.
  • The exact effects on confidentiality, integrity and availability in a real deployment are not described beyond the vector.

Affected products and versions

  • Product named in the record: TOTOLINK A8000RU, firmware 7.1cu.643_b20200521.
  • The record's affected list is empty, so no version range has been formally published in the sources consulted.
  • Other firmware builds of this product are not addressed in the record and should be treated as unknown.

Exploitation status

The record states that an exploit has been published and may be used. The device is not listed in the CISA Known Exploited Vulnerabilities catalog in the record. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. The EPSS value recorded is 0.03253 (percentile 0.88048).

Remediation and mitigation

  • No fixed firmware version is listed in the record. Check the vendor website for an updated firmware and apply it if one is available for your model.
  • If no patch is available, restrict access to the web management interface to trusted administrative networks, disable remote management from the internet, and place the device behind a firewall that blocks untrusted access.
  • Replace devices that are no longer supported by the vendor, since missing patches would leave the flaw open.
  • Review the vendor's security guidance at TOTOLINK.

Detection guidance

  • Review web server and management logs for unexpected or non-standard requests to /cgi-bin/cstecgi.cgi from unknown sources.
  • Monitor the device for unexplained configuration changes, new accounts, or unusual outbound connections.
  • Inventory all TOTOLINK A8000RU devices and their firmware versions to find exposed units.

Limitations of the available information

  • The record gives no fixed version, no vendor advisory and no confirmed affected version range.
  • The EPSS date in the record (2026-10-13) is later than the publication date; this analysis reports the values as recorded.
  • The record's source status is Deferred, so details may change as the CVE is reviewed.
  • The referenced third-party write-up is not summarized here, and its technical content is intentionally excluded.

Frequently asked questions

Is CVE-2026-7139 being actively exploited?

The record states that an exploit has been published and may be used, but the device is not listed in CISA KEV and no confirmed active exploitation appears in the sources consulted.

Is there a fixed firmware version for the TOTOLINK A8000RU?

The record does not list a fixed version. Check the vendor website for updated firmware and apply it if available for your model.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.