CVE-2026-7538: Totolink A8000RU OS Command Injection in cstecgi.cgi
A command injection flaw in the cstecgi.cgi CGI Handler of Totolink A8000RU 7.1cu.643_b20200521 is reported as remotely triggerable through the proto argument. The CNA (VulDB) scores it 9.8 under CVSS 3.1, and the record states that a public exploit is available. No KEV listing or confirmed exploitation appears in the sources consulted.
Overview
The CNA record describes a vulnerability in the Totolink A8000RU, version string 7.1cu.643_b20200521. The issue is located in the Vulnerability function of the file /cgi-bin/cstecgi.cgi, which belongs to the CGI Handler component. It is classified as CWE-77 (Command Injection) and the record states that manipulating the proto argument leads to OS command injection.
Impact
- The CNA assigns a CVSS 3.1 base score of 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
- Under that vector, the attack is network-based, requires no privileges and no user interaction, and has high impact on confidentiality, integrity and availability. This reading of the vector is our inference.
- The same CNA also reports a CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10.
- Successful command injection on an embedded device would generally allow the attacker to run commands in the device context. The sources consulted do not describe the exact effects in this model.
Affected products and versions
The structured data in the record contains no affected-product or version entries. The only version named in the description is Totolink A8000RU 7.1cu.643_b20200521. Whether other firmware builds or hardware revisions are affected is unknown from the sources consulted.
Exploitation status
The CVE is not listed in the CISA KEV catalog in the record, so no confirmed exploitation in the wild is documented there. The description states that a public exploit is available and might be used. The EPSS probability in the record is 0.03253 with a percentile of 0.8806, which indicates a relatively high estimated likelihood of exploitation compared with other CVEs, but this is a statistical estimate and not evidence of attacks.
Remediation and mitigation
- No vendor fix is listed in the record. The absence of a listed fix does not mean none exists; check the Totolink website for firmware updates for the A8000RU.
- Until a fix is confirmed, limit exposure of the device's web management interface. Do not expose it to the internet, and restrict access to trusted administrative networks.
- Review whether remote management features are enabled and disable them when they are not required.
- If the device cannot be patched, consider isolating it or replacing it with a supported model.
Detection guidance
- Review web server and CGI access logs for unexpected requests to /cgi-bin/cstecgi.cgi, especially from unknown external addresses.
- Monitor the device for unexpected outbound connections, configuration changes or restarts.
- Inventory all Totolink A8000RU devices and record their firmware versions to support triage.
Limitations of the available information
The record has no fixed version, no vendor advisory listed in the structured references, no KEV data and no affected-version range beyond the single version string. The exploit referenced in the description is not characterized in the record, and the sources consulted do not confirm real-world attacks. Details of the vendor response are unknown.
Frequently asked questions
What is CVE-2026-7538?
It is a command injection vulnerability in the cstecgi.cgi CGI Handler of the Totolink A8000RU, version string 7.1cu.643_b20200521, reported by the CNA with a CVSS 3.1 score of 9.8.
Is there a fix available?
No fixed version is listed in the record. Check the Totolink website for firmware updates, and treat the lack of a listed fix as unknown rather than as proof that none exists.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.