CVE Intelligence
Analysis AI-assisted

CVE-2026-7240: Totolink A8000RU OS Command Injection in CGI Handler

A vulnerability in the CGI Handler component of Totolink A8000RU firmware 7.1cu.643_b20200521 allows OS command injection through a manipulated argument, according to the CNA VulDB record. The record states that the attack can be executed remotely and that the exploit has been publicly disclosed. CISA KEV does not list this CVE, and the CNA reports a CVSS v3.1 base score of 9.8.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

VulDB has published CVE-2026-7240 for Totolink A8000RU firmware 7.1cu.643_b20200521. The record places the flaw in the CGI Handler component, in a VPN account configuration function, where a user-supplied argument can lead to operating system command injection (CWE-77).

Impact

  • According to the record, a remote attacker could potentially execute operating system commands on the device.
  • The CVSS v3.1 vector reported by the CNA indicates high impact on confidentiality, integrity and availability, with no privileges or user interaction required.
  • A successful command injection on a router or gateway could expose network traffic and device configuration. This is an inference from the vulnerability class, not a confirmed outcome.

Affected products and versions

  • The record names Totolink A8000RU firmware 7.1cu.643_b20200521 as the affected version.
  • No other affected versions or ranges are listed in the record.
  • Fixed versions: none are listed in the record. This is unknown, not confirmed absent. Check the vendor site at Totolink.

Exploitation status

  • The CNA states that the exploit has been publicly disclosed and may be used.
  • CISA KEV does not list this CVE.
  • No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Check the vendor site for firmware updates for the A8000RU line and apply any fixed release once it is confirmed.
  • Until a fix is confirmed, restrict access to the device management interface to trusted administrative networks and do not expose it to the internet.
  • Disable remote management and VPN features that are not in use.
  • Follow the CVE record and vendor notices for updates, since the source status is listed as Deferred.

Detection guidance

  • Monitor device logs and network traffic for unexpected administrative requests to the CGI interface and for unusual outbound connections from the router.
  • Compare device configuration and firmware version against a known good baseline.
  • Treat unexplained changes to VPN accounts as a possible indicator of compromise.

Limitations of the available information

  • The record includes no vendor advisory, no fixed version and no confirmed exploitation timeline.
  • The EPSS data in the record carries a date later than the publication date, so treat those metrics with caution.
  • The source status is Deferred, so this analysis may change.
  • The CNA also provides CVSS 4.0 and 2.0 scores without their vector strings.

Frequently asked questions

Is CVE-2026-7240 known to be exploited in the wild?

CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. The CNA does state that a public exploit has been disclosed.

Which version is affected and is a fix available?

The record names Totolink A8000RU firmware 7.1cu.643_b20200521 as affected. No fixed version is listed, so the fix status is unknown and should be checked with the vendor.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.