CVE-2026-7154: Totolink A8000RU OS Command Injection in setAdvancedInfoShow

Overview

CVE-2026-7154 describes a command injection weakness in the setAdvancedInfoShow function, reached through /cgi-bin/cstecgi.cgi, in the CGI Handler component of Totolink A8000RU firmware 7.1cu.643_b20200521. According to the CNA description, manipulating the tty_server argument can lead to operating system command injection. The full entry is available in the VulDB entry and the CVE record.

Impact

Command injection can let an attacker run operating system commands with the privileges of the vulnerable service. The CNA scores the issue as critical, with a CVSS 3.1 base score of 9.8 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which reflects network reachability, low complexity, no required privileges or user interaction, and high confidentiality, integrity and availability impact. The same CNA also lists a CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10.

Affected products and versions

Product: Totolink A8000RU
Version named in the record: 7.1cu.643_b20200521
Affected and fixed version ranges are not provided in the record, so the full scope is unknown.

Exploitation status

The CNA description states that the exploit has been made available to the public and could be used for attacks. The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record, and no confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

Check the vendor site for firmware updates for the A8000RU line, via the Totolink website, and apply any fixed release that addresses this issue.
Until a fix is verified, restrict access to the device management interface, keep it off untrusted networks and the internet, and disable remote administration where possible.
Treat devices running the named firmware as high priority for review given the critical score and public exploit mention.
Because no fixed version is listed in the record, do not assume the current firmware is safe; confirm with the vendor.

Detection guidance

Review web server and CGI access logs for unusual requests to /cgi-bin/cstecgi.cgi, especially those targeting advanced information or diagnostic functions.
Monitor the device for unexpected outbound connections or newly created processes or files, which can indicate that commands were run.
Segment and monitor traffic to management interfaces so that unexpected sources are visible.

Limitations of the available information

The record gives no confirmed fixed version, no vendor advisory, no list of affected products beyond one firmware string, and no CVSS data from NVD or CISA ADP in the fields provided. Exploit availability is stated by the CNA, but its maturity and reliability were not verified here. EPSS data is present, but its date field is not reliable for timing analysis and should be checked against the source.

Frequently asked questions

What is CVE-2026-7154?

It is a command injection weakness (CWE-77) in the setAdvancedInfoShow function of the CGI handler on Totolink A8000RU firmware 7.1cu.643_b20200521.

How severe is it?

The CNA VulDB rates it critical, with a CVSS 3.1 base score of 9.8 and a network attack vector requiring no privileges or user interaction.

Is it being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The CNA does state that a public exploit is available.

Is there a fixed version?

The record does not list any fixed version, so this is unknown. Check the vendor for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.