CVE-2026-7155: Totolink A8000RU OS Command Injection via setLoginPasswordCfg admpass Parameter

Overview

CVE-2026-7155 is a command injection weakness (CWE-77) affecting the setLoginPasswordCfg function handled by the CGI Handler component of Totolink A8000RU, version 7.1cu.643_b20200521. The record states that the admpass argument is processed in a way that allows operating system command injection. The CVE was published on 2026-04-27 by the CNA cna@vuldb.com, and its source status is listed as Deferred.

Impact

• The CNA-provided CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8 (critical), indicating network-reachable exploitation without privileges or user interaction.
• A successful command injection could allow an attacker to affect confidentiality, integrity and availability of the device, according to the vector components.
• The record also lists CVSS 4.0 (8.9) and CVSS 2.0 (10) scores from the same CNA; these are reported as provided and have not been independently verified.

Affected products and versions

• Product: Totolink A8000RU.
• Affected version stated in the record: 7.1cu.643_b20200521.
• The structured affected list in the record is empty, so other versions are unknown.

Exploitation status

• The record states that the exploit has been publicly disclosed and may be used.
• The CISA KEV catalog entry is marked as not listed in the record, so this analysis does not state that the vulnerability is exploited in the wild.
• The EPSS probability is 0.03253 (percentile 0.88047), a statistical estimate of exploitation likelihood and not a confirmation of attacks.

Remediation and mitigation

• No fixed version is provided in the record. The absence of fix data does not mean no fix exists; administrators should check the vendor site and the Totolink product page for firmware updates.
• Until an update is verified, reduce exposure by restricting access to the device administration interface, removing internet-facing management access, and segmenting IoT or router management networks.
• Replace devices that are no longer supported by the vendor if no update is available.

Detection guidance

• Review device logs and web server access logs for unusual requests to the cstecgi.cgi endpoint, especially those involving password-configuration parameters.
• Monitor for unexpected configuration changes, new administrative accounts, or outbound connections originating from the router.
• Treat any unexplained device behavior as a potential compromise and investigate accordingly.

Limitations of the available information

• The record does not provide a fixed version, a vendor advisory, or confirmed affected version ranges beyond the single version string.
• The public references are a VulDB submission and entry, a GitHub repository README, and the vendor homepage; their technical content was not independently verified in this analysis.
• Whether the vendor has acknowledged or patched the issue is unknown.

Frequently asked questions

What is CVE-2026-7155?

It is a command injection vulnerability (CWE-77) in the setLoginPasswordCfg function of the CGI Handler in Totolink A8000RU firmware 7.1cu.643_b20200521, triggered through the admpass argument.

Is this vulnerability known to be exploited in the wild?

The record marks it as not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The record does state that a public exploit has been disclosed.

Is there a fixed version?

The record does not list a fixed version. This does not prove no fix exists, so check the vendor for firmware updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.