Which versions of TOTOLINK A8000RU are affected by CVE-2026-7138?

A critical OS command injection vulnerability (CVE-2026-7138, CVSS 8.9) in TOTOLINK A8000RU routers permits unauthenticated remote attackers to execute arbitrary system commands via the NTP…

Is there a public PoC exploit available for CVE-2026-7138?

Yes, a public proof-of-concept exploit is available for CVE-2026-7138. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-7138?

Within 24 hours, conduct a complete inventory of TOTOLINK A8000RU routers and identify all systems running firmware 7.1cu.643_b20200521 or earlier; immediately implement network segmentation to isolate affected devices to a management-only network and revoke external administrative access if operationally feasible. Within 7 days, deploy perimeter firewall rules blocking all unauthorized external traffic to the vulnerable /cgi-bin/cstecgi.cgi endpoint, configure IDS/IPS detection signatures for command injection patterns targeting the setNtpCfg function, and enable full audit logging of administrative access to affected routers. Within 30 days, evaluate router replacement timelines or establish a permanent compensating control strategy, actively monitor TOTOLINK security advisories for patch availability, and assess whether NTP configuration can be disabled to eliminate attack surface.

TOTOLINK A8000RU CVE-2026-7138

Q: What is the CVSS score of CVE-2026-7138?

CVE-2026-7138 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-25876 HIGH

OS Command Injection (CWE-78)

2026-04-27 VulDB

Command Injection TOTOLINK A8000Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable CGI endpoint (AV:N/AC:L/PR:N/UI:N) with unsanitized tz passed to a shell yields root command execution, giving full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:51 vuln.today

PoC Detected

Apr 27, 2026 - 18:35 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 16:22 NVD

CRITICAL HIGH

CVSS changed

Apr 27, 2026 - 16:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 16:15 euvd

EUVD-2026-25876

CVE Published

Apr 27, 2026 - 16:00 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument tz results in os command injection. The attack can be executed remotely. The exploit is now public and may be used.

AnalysisAI

OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote unauthenticated attackers execute arbitrary system commands by manipulating the 'tz' parameter of the setNtpCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (published via VulDB), and the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, total impact) reflects unauthenticated network reachability with full compromise, though EPSS remains modest at 0.89%. This is no public exploit identified as actively exploited - there is no CISA KEV listing at time of analysis.

Technical ContextAI

The affected component is the CGI Handler exposed at /cgi-bin/cstecgi.cgi, a single dispatch endpoint used across many TOTOLINK SOHO routers that routes requests to internal handler functions such as setNtpCfg (NTP/time-zone configuration). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the 'tz' (time zone) argument is passed into a shell/system call without sanitization, so shell metacharacters injected into tz are interpreted by the underlying BusyBox/Linux shell and executed with the privileges of the web server process, typically root on these embedded devices. The single affected CPE is cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:* (firmware 7.1cu.643_b20200521).

RemediationAI

No vendor-released patch identified at time of analysis - TOTOLINK has not published a fixed firmware version in the available data, so monitor https://www.totolink.net/ for a firmware update superseding 7.1cu.643_b20200521 and apply it once released. As compensating controls, restrict access to the router's web/management interface so /cgi-bin/cstecgi.cgi is not reachable from the WAN or untrusted LAN segments (disable remote/WAN administration entirely, which stops internet-based exploitation but not a hostile local user), and place the device behind a firewall that blocks inbound HTTP/HTTPS to the management port from all but explicitly trusted admin hosts. Where feasible, retire or replace the affected device given its history of cstecgi.cgi command-injection flaws. Track the vulnerability record at https://vuldb.com/vuln/359737 and the POC at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_313/README.md for updates.