Which versions of Totolink A8000RU are affected by CVE-2026-7037?

Totolink A8000RU router firmware versions up to 7.1cu.643_b20200521 contain a critical remote command injection vulnerability that allows unauthenticated attackers to gain complete control of…

Is there a public PoC exploit available for CVE-2026-7037?

Yes, a public proof-of-concept exploit is available for CVE-2026-7037. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-7037?

Within 24 hours: Identify all Totolik A8000RU devices in your environment using network scanning tools and asset management systems, prioritize internet-facing instances for immediate isolation. Within 7 days: Contact Totolik technical support to confirm patch availability and timeline; check for firmware versions newer than 7.1cu.643_b20200521 as interim mitigation. Within 30 days: Either deploy confirmed patched firmware (request specific version from vendor), replace affected devices with alternative router models that have active security support, or implement network segmentation to isolate these devices from sensitive systems and untrusted networks.

Totolink A8000RU CVE-2026-7037

Q: What is the CVSS score of CVE-2026-7037?

CVE-2026-7037 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-25713 HIGH

OS Command Injection (CWE-78)

2026-04-26 VulDB

Command Injection A8000Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 18:52 vuln.today

cvss_changed

PoC Detected

Apr 27, 2026 - 18:50 vuln.today

Public exploit code

Analysis Generated

Apr 26, 2026 - 12:30 vuln.today

Severity Changed

Apr 26, 2026 - 12:22 NVD

CRITICAL HIGH

CVSS changed

Apr 26, 2026 - 12:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

EUVD ID Assigned

Apr 26, 2026 - 12:00 euvd

EUVD-2026-25713

Analysis Generated

Apr 26, 2026 - 12:00 vuln.today

CVE Published

Apr 26, 2026 - 11:45 nvd

HIGH 8.9

DescriptionCVE.org

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument pptpPassThru results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 enables remote unauthenticated attackers to execute arbitrary system commands via the pptpPassThru parameter in the setVpnPassCfg function. Public exploit code exists on GitHub, dramatically lowering the barrier to exploitation. CVSS v4.0 base score of 8.9 reflects network attack vector, low complexity, and no authentication requirements, with high impact to confidentiality, integrity, and availability of the vulnerable device.

Technical ContextAI

This vulnerability exploits CWE-78 (OS Command Injection) in the CGI handler of Totolink A8000RU router firmware, specifically affecting /cgi-bin/cstecgi.cgi. The setVpnPassCfg function fails to properly sanitize user input in the pptpPassThru parameter before passing it to system shell commands. CGI (Common Gateway Interface) scripts in embedded devices often execute with elevated privileges, making command injection particularly severe. The affected CPE cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:* indicates this is a software vulnerability in the router's application firmware. Legacy CGI implementations in SOHO routers frequently lack modern input validation frameworks, relying instead on ad-hoc string handling that fails to account for shell metacharacters.

RemediationAI

Check the Totolink support website at https://www.totolink.net/ for firmware updates newer than 7.1cu.643_b20200521 that may address this command injection vulnerability, though no vendor-released patch has been independently confirmed at time of analysis. As an immediate compensating control, disable remote administration access to the router's web interface by restricting management access to LAN-only connections in the administration settings-this eliminates the network attack vector (AV:N) but sacrifices remote management capability. Deploy the router behind a firewall that blocks external access to TCP ports 80, 443, and 8080 to the device's WAN interface. For environments requiring VPN functionality, consider replacing the affected device with alternative hardware that receives active security support. Monitor router logs for unusual cstecgi.cgi access patterns or unexpected system process execution, though logging capabilities on SOHO devices are typically limited. Given the age of the affected firmware build (May 2020) and typical vendor support lifecycles for consumer networking equipment, hardware replacement may be more practical than waiting for a patch.