CVE-2026-7152: Totolink A8000RU OS Command Injection in setTelnetCfg

Overview\nCVE-2026-7152 is an OS command injection flaw (CWE-77) in the setTelnetCfg function, served by the CGI Handler component at /cgi-bin/cstecgi.cgi on the Totolink A8000RU, firmware 7.1cu.643_b20200521. According to the CNA record, improper handling of the telnet_enabled argument allows an attacker to influence operating system commands.\n\n## Impact\n- The record states that the flaw can be exploited remotely, which is consistent with the CVSS 3.1 vector assigned by the CNA (network attack vector, no privileges, no user interaction).\n- Under the CVSS 3.1 score of 9.8 listed by the CNA, the potential impact on confidentiality, integrity and availability is rated high. This is the CNA's assessment, not an independent analysis.\n- Command injection in network device firmware can, in general, lead to full control of the device, so the operational impact depends on the device's role and exposure (inference).\n\n## Affected products and versions\n- Product: Totolink A8000RU.\n- Version listed in the record: 7.1cu.643_b20200521.\n- The record's affected list is empty, so other firmware builds cannot be confirmed as affected or unaffected from the sources consulted.\n\n## Exploitation status\n- The record states that a public exploit is available and might be used.\n- The CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.\n- The EPSS probability in the record is 0.03253 (percentile 0.88043); this is a statistical estimate, not evidence of exploitation.\n\n## Remediation and mitigation\n- The record does not identify a fixed version or vendor patch. Check the Totolink website for firmware updates and contact the vendor for guidance on this model.\n- Until a verified fix is confirmed, restrict access to the device's web management interface to trusted administrative networks only, and do not expose it to the internet.\n- If the telnet service is not required, disable it, since the affected parameter relates to telnet configuration.\n- Segment the device from sensitive networks and review whether it should remain in service.\n\n## Detection guidance\n- Review web server and device logs for unexpected requests to /cgi-bin/cstecgi.cgi, especially from unknown sources.\n- Monitor for unexpected changes to telnet configuration or unexpected outbound connections from the device.\n- Maintain an asset inventory to identify all Totolink A8000RU devices and their firmware versions.\n\n## Limitations of the available information\n- The record gives no fixed version, patch details, or confirmed list of affected builds.\n- Scores for CVSS 4.0 (8.9) and CVSS 2.0 (10) are provided by the CNA; no independent scoring from NVD is included in the record.\n- The publicly available exploit is mentioned in the description only; this analysis does not assess its functionality.\n- The EPSS date in the record is not used for interpretation.

Frequently asked questions

Is CVE-2026-7152 being actively exploited?

The record is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit is available.

Which Totolink A8000RU versions are affected?

The record lists firmware 7.1cu.643_b20200521 and provides no other affected versions. Other builds cannot be confirmed from the available sources.

Is there a fix for this vulnerability?

The record does not list a fixed version. Check the vendor website for updates and apply any verified firmware fix when it becomes available.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.