CVE Intelligence
Analysis AI-assisted

CVE-2026-7156: Totolink A8000RU OS command injection in CGI handler

A command injection flaw in the CsteSystem function reached through /cgi-bin/cstecgi.cgi on Totolink A8000RU firmware 7.1cu.643_b20200521 can be triggered remotely, according to the CNA VulDB. The CNA rates it critical with a CVSS 3.1 score of 9.8, and the record states a public exploit exists. The record does not show a CISA KEV listing, confirmed exploitation, or a fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The CNA VulDB reports a command injection flaw in Totolink A8000RU firmware 7.1cu.643_b20200521. The issue is in the CsteSystem function reached through /cgi-bin/cstecgi.cgi, part of the CGI Handler component. The record classifies it as CWE-77 (Command Injection).

Impact

  • The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a remote attack with low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
  • Command injection can allow operating system commands to run on the device. The actual outcome depends on device configuration, which the record does not describe.
  • The CNA also provides CVSS 4.0 (8.9) and CVSS 2.0 (10) scores.

Affected products and versions

  • Product: Totolink A8000RU, firmware string 7.1cu.643_b20200521 as named in the record.
  • The structured affected list in the record is empty, so other versions or builds cannot be confirmed as affected or unaffected.

Exploitation status

  • The record states that the exploit is public and may be used.
  • The record shows no CISA KEV listing. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • The record lists no fixed version. That does not mean no fix exists. Check the vendor site at Totolink for firmware updates.
  • Limit access to the device management interface to trusted networks, and disable remote administration where it is not needed.
  • If no vendor update is available, plan to replace or retire the device.

Detection guidance

  • Review device logs and web management access for unexpected requests to the cstecgi.cgi endpoint from unknown sources.
  • Monitor traffic to and from the device for unexpected outbound connections or configuration changes.

Limitations of the available information

  • The record contains no vendor advisory details, patch status, or complete list of affected builds.
  • The EPSS values in the record (probability 0.03253, percentile 0.8804) are dated 2026-10-13. Verify them against the current EPSS data.
  • The record marks the source status as Deferred, and its meaning is not explained.

Frequently asked questions

Is CVE-2026-7156 known to be exploited in the wild?

The record does not list the CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted. The record does state that a public exploit exists and may be used.

Which versions are affected?

The record names firmware 7.1cu.643_b20200521 of the Totolink A8000RU. Its structured affected list is empty, so other builds cannot be confirmed.

What should administrators do now?

No fixed version is listed. Check the vendor for updates, restrict management interface access to trusted networks, and monitor the device for unexpected requests to cstecgi.cgi.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.