CVE-2026-7153: Totolink A8000RU OS Command Injection in setMiniuiHomeInfoShow

Overview

CVE-2026-7153 affects the CGI Handler of the Totolink A8000RU router, specifically the setMiniuiHomeInfoShow function reached through /cgi-bin/cstecgi.cgi. According to the record, manipulating the sys_info argument leads to operating system command injection (CWE-77). The CNA is VulDB, and the record was published on 2026-04-27 with status Deferred.

Impact

The CNA scores the issue 9.8 (Critical) under CVSS 3.1 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network access, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. This is the CNA's assessment; the record does not include a NVD or other independent score.

• Successful command injection would generally let an attacker run commands with the privileges of the vulnerable service on the device.
• The record does not describe the precise privileges of the affected process, so the practical scope is unknown.

Affected products and versions

The record identifies Totolink A8000RU with firmware 7.1cu.643_b20200521 as the impacted product. The structured affected and fixes fields are empty, so no official list of other affected builds or fixed versions is available in the record. The absence of a fixed version does not mean no fix exists; it means the record does not provide one.

Exploitation status

The record states that the exploit has been released to the public and may be used for attacks. CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.03253 with a percentile of 0.88043, which is a statistical estimate and not evidence of observed exploitation.

Remediation and mitigation

• Check whether the vendor has released a firmware update for the A8000RU and apply it. The record provides no vendor advisory or fixed version, so consult the Totolink site and official channels.
• Until a verified fix is available, restrict access to the device management interface to trusted administrative networks and avoid exposing it to the internet.
• Replace or isolate the device if it cannot be updated and is internet-facing, and review whether the device is still supported.

Detection guidance

• Review web management logs for requests to /cgi-bin/cstecgi.cgi containing unusual or unexpectedly long parameter values.
• Monitor the device for unexpected outbound connections, new processes or configuration changes that could indicate command execution.
• Treat any unexplained behavior on an exposed A8000RU as a potential compromise and investigate it.

Limitations of the available information

The record does not include a vendor advisory, a confirmed fixed firmware version, a list of affected versions beyond the single firmware string, or independent CVSS scores from NVD. The CVSS and CWE data come from the CNA, and the exploit publication claim comes from the record description without a linked exploit repository being verified here. Whether the public exploit is effective on other firmware builds is unknown.

Frequently asked questions

Is CVE-2026-7153 being actively exploited?

CISA KEV does not list this CVE, and the sources consulted do not confirm exploitation in the wild. The record does state that a public exploit exists and may be used for attacks.

Which product and version are affected?

The record names the Totolink A8000RU with firmware 7.1cu.643_b20200521. The structured affected list is empty, so other builds cannot be confirmed from the record.

What should administrators do now?

Check the vendor for a firmware update, restrict management interface access to trusted networks, avoid internet exposure, and review logs for unusual requests to the management CGI endpoint.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.