CVE Intelligence
Analysis AI-assisted

CVE-2026-7140: Totolink A8000RU OS Command Injection in CGI Handler

CVE-2026-7140 is an OS command injection vulnerability in the CsteSystem function of the CGI Handler component of Totolink A8000RU firmware 7.1cu.643_b20200521, as described by the CNA VulDB. The CNA rates it critical, with a CVSS 3.1 base score of 9.8 and a network attack vector. The record states that exploit details have been disclosed publicly, but CISA KEV does not list it and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-7140 was published on 2026-04-27 by the CNA VulDB. The record describes an OS command injection flaw (CWE-77) in the CsteSystem function of the CGI Handler component of Totolink A8000RU firmware version 7.1cu.643_b20200521. The record's source status is Deferred.

Impact

  • The CNA-provided CVSS 3.1 base score is 9.8 (critical). The vector indicates a network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality, integrity and availability impact.
  • The CNA also provides a CVSS 4.0 score of 8.9 and a 2.0 score in the record.
  • Command injection, if successfully triggered, would generally allow commands to run with the privileges of the affected service on the device. This is an inference from the vulnerability class and has not been verified by the sources consulted.

Affected products and versions

  • The record names Totolink A8000RU 7.1cu.643_b20200521 as the affected version.
  • The structured affected list in the record is empty, so no broader version range is confirmed.
  • No fixed version is listed in the record. The absence of a listed fix does not mean that no fix exists.

Exploitation status

  • CISA KEV does not list this CVE, so the record does not confirm active exploitation in the wild.
  • The record states that the exploit has been disclosed to the public and may be used. The EPSS probability is 0.03253 (percentile 0.88048) as recorded.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Identify all Totolink A8000RU devices in your environment and check whether any run the affected firmware version.
  • Check the vendor site for an updated firmware release. The record does not identify a fixed version.
  • Until a fix is confirmed, reduce exposure: restrict access to the device management interface, avoid exposing it to the internet, and place it behind network controls that limit who can reach it.
  • Disable remote management features that are not required.

Detection guidance

  • Review device and network logs for unexpected requests to the management CGI interface, especially from unfamiliar sources.
  • Monitor for unexpected outbound connections or configuration changes originating from the device.
  • Treat any device showing signs of unauthorized command execution as compromised and follow your incident response process.

Limitations of the available information

  • The record gives no fixed version, no vendor advisory, and no confirmed affected range beyond the single firmware version named.
  • The record does not include proof-of-concept code, and this analysis does not provide any.
  • Exploit availability is described only by the CNA and the referenced third-party pages; exploitation in the wild is not confirmed by the sources consulted.

Frequently asked questions

Is CVE-2026-7140 known to be actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that exploit details have been publicly disclosed.

Which versions are affected?

The record names Totolink A8000RU firmware 7.1cu.643_b20200521. The structured affected list is empty, so a broader range is not confirmed, and no fixed version is listed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.