Which versions of TOTOLINK A8000RU are affected by CVE-2026-7137?

TOTOLINK A8000RU routers (firmware 7.1cu.643_b20200521 and related versions) are vulnerable to unauthenticated remote code execution via OS command injection in the device's web interface.

Is there a public PoC exploit available for CVE-2026-7137?

Yes, a public proof-of-concept exploit is available for CVE-2026-7137. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-7137?

Within 24 hours: Identify all TOTOLINK A8000RU routers in production and document affected firmware versions; implement network segmentation to isolate these devices from critical systems and untrusted networks. Within 7 days: Deploy WAF or IPS rules to block requests to /cgi-bin/cstecgi.cgi containing suspicious sambaEnabled parameters; restrict administrative interface access by IP whitelist and disable remote management unless operationally required. Within 30 days: Escalate to TOTOLINK support for firmware patches or security guidance; evaluate replacement with alternative router vendors that maintain active security update cycles; conduct log forensics to detect any indicators of compromise during the vulnerability exposure window.

TOTOLINK A8000RU CVE-2026-7137

Q: What is the CVSS score of CVE-2026-7137?

CVE-2026-7137 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-25875 HIGH

OS Command Injection (CWE-78)

2026-04-27 VulDB

Command Injection TOTOLINK A8000Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network request to the CGI handler yields command execution as router root, so PR:N/UI:N/AC:L with full C/I/A impact; scope unchanged as the OS is the vulnerable component.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:51 vuln.today

PoC Detected

Apr 27, 2026 - 18:35 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 16:22 NVD

CRITICAL HIGH

CVSS changed

Apr 27, 2026 - 16:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 16:15 euvd

EUVD-2026-25875

CVE Published

Apr 27, 2026 - 15:45 nvd

HIGH 8.9

DescriptionCVE.org

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument sambaEnabled leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

AnalysisAI

OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the sambaEnabled argument passed to the setStorageCfg function in /cgi-bin/cstecgi.cgi. The CVSS 4.0 vector indicates network-reachable, unauthenticated exploitation (AV:N/PR:N/UI:N) with total impact on confidentiality, integrity, and availability. Publicly available exploit code exists (VulDB), though EPSS remains modest at 0.89% (76th percentile) and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the cstecgi.cgi CGI handler, the central request dispatcher used across many TOTOLINK SOHO routers, which routes JSON-style requests to internal handler functions such as setStorageCfg (used to configure USB/Samba storage sharing). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the sambaEnabled parameter is incorporated into a shell command without adequate sanitization, so shell metacharacters allow attacker-controlled commands to run in the router's underlying BusyBox/Linux environment, typically as root. The single affected CPE is cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:*, matching the A8000RU product line.

RemediationAI

No vendor-released patch is identified at time of analysis; the references (https://vuldb.com/vuln/359736 and the exploit writeup at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_312/README.md) do not cite a fixed firmware version. Check https://www.totolink.net/ for updated firmware for the A8000RU and apply it once released. As compensating controls until a patch exists: disable remote/WAN management so the web interface (and /cgi-bin/cstecgi.cgi) is not reachable from the internet - trade-off is loss of remote administration; restrict access to the router's HTTP management interface to trusted LAN hosts via firewall/ACLs; and disable the USB storage/Samba sharing feature that setStorageCfg configures if it is not required, which removes the affected functionality at the cost of losing network storage. Given the device's end-user nature and possible end-of-life status, consider replacing the router if no firmware fix is forthcoming.