Which versions of TOTOLINK A8000RU are affected by CVE-2026-7136?

Organizations operating TOTOLINK A8000RU routers face immediate exposure to remote command injection attacks that grant adversaries complete control of affected devices.

Is there a public PoC exploit available for CVE-2026-7136?

Yes, a public proof-of-concept exploit is available for CVE-2026-7136. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-7136?

Within 24 hours: identify and inventory all TOTOLINK A8000RU routers currently deployed, prioritize isolation of routers exposed to external networks, and disable remote management access to CGI handlers if possible. Within 7 days: execute replacement of affected devices with alternative routers running current, patched firmware, or implement rigorous network segmentation to isolate vulnerable hardware from sensitive systems. Within 30 days: confirm complete replacement of all vulnerable firmware versions from inventory, implement network-based intrusion detection to monitor for exploitation attempts, and establish patch management processes to prevent similar vulnerabilities in future deployments.

TOTOLINK A8000RU CVE-2026-7136

Q: What is the CVSS score of CVE-2026-7136?

CVE-2026-7136 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-25874 HIGH

OS Command Injection (CWE-78)

2026-04-27 VulDB

Command Injection TOTOLINK A8000Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable CGI parameter injection with no auth or interaction per the supplied vector yields command execution at root, giving full C/I/A impact; PR:N retained though firmware-level auth should be verified.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:52 vuln.today

PoC Detected

Apr 27, 2026 - 18:35 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 16:22 NVD

CRITICAL HIGH

CVSS changed

Apr 27, 2026 - 16:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 16:15 euvd

EUVD-2026-25874

CVE Published

Apr 27, 2026 - 15:30 nvd

HIGH 8.9

DescriptionCVE.org

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wanIdx can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote attackers inject arbitrary operating-system commands through the wanIdx argument of the setDmzCfg handler in /cgi-bin/cstecgi.cgi. The CGI Handler passes attacker-controlled input into a shell context without sanitization, yielding full command execution on the device. Publicly available exploit code exists and the SSVC framework rates technical impact as total and the attack as automatable, though it is not listed in CISA KEV and EPSS remains modest at 0.89%.

Technical ContextAI

The A8000RU is a consumer/SOHO wireless router whose web management interface is driven by the cstecgi.cgi binary, a common CGI dispatcher across TOTOLINK firmware that routes JSON/form requests to internal handler functions such as setDmzCfg (DMZ configuration). This is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw: the wanIdx parameter is concatenated into a system/shell call - typically to program firewall or network-index settings - without input validation or escaping, so shell metacharacters (;, |, `, $()) break out of the intended command. The single affected artifact per CPE cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:* and EUVD is firmware build 7.1cu.643_b20200521.

RemediationAI

No vendor-released patch identified at time of analysis - TOTOLINK has not published a fixed firmware version in the available references, so monitor https://www.totolink.net/ for an updated build superseding 7.1cu.643_b20200521. As compensating controls, disable remote/WAN-side access to the web administration interface so /cgi-bin/cstecgi.cgi is unreachable from the internet (trade-off: no off-LAN management), and restrict management to trusted hosts on the LAN via ACLs or a management VLAN. Avoid using or exposing the DMZ configuration feature that reaches setDmzCfg, change default administrative credentials, and place the device behind an upstream firewall that blocks inbound access to the HTTP admin port; if the model is end-of-support, plan replacement with a currently-maintained router. Validate any PoC-derived indicators (unexpected processes/outbound connections) since exploit code is public (https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_311/README.md).