Which versions of TOTOLINK A8000RU are affected by CVE-2026-7139?

The TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521 and earlier) contains a critical remote command execution vulnerability (CVE-2026-7139) allowing unauthenticated attackers to gain complete…

Is there a public PoC exploit available for CVE-2026-7139?

Yes, a public proof-of-concept exploit is available for CVE-2026-7139. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-7139?

Within 24 hours: Identify all TOTOLINK A8000RU routers in production (firmware version 7.1cu.643_b20200521 and earlier) and immediately isolate affected devices from production networks or block remote access to the management interface via firewall rules. Within 7 days: Contact TOTOLINK support to confirm the latest available firmware version; if no security patch is available, implement network segmentation by placing affected routers on an isolated VLAN with restricted management access, and deploy web application firewall rules to block requests to /cgi-bin/cstecgi.cgi. Within 30 days: Execute a replacement strategy to migrate to alternative router models from vendors with proven security patch cadence and discontinue use of TOTOLINK A8000RU units.

TOTOLINK A8000RU CVE-2026-7139

Q: What is the CVSS score of CVE-2026-7139?

CVE-2026-7139 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-25878 HIGH

OS Command Injection (CWE-78)

2026-04-27 VulDB

Command Injection TOTOLINK A8000Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote unauthenticated command injection with no user interaction (AV:N/AC:L/PR:N/UI:N); commands run as root on the device yielding full C/I/A loss, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:50 vuln.today

PoC Detected

Apr 27, 2026 - 18:35 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 17:22 NVD

CRITICAL HIGH

CVSS changed

Apr 27, 2026 - 17:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 17:00 euvd

EUVD-2026-25878

CVE Published

Apr 27, 2026 - 16:15 nvd

HIGH 8.9

DescriptionCVE.org

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mode causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

AnalysisAI

OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote, unauthenticated attackers execute arbitrary shell commands by manipulating the 'mode' parameter passed to the setWiFiAclRules function in the /cgi-bin/cstecgi.cgi CGI handler. Publicly available exploit code exists (VulDB) and SSVC rates it automatable with total technical impact, though EPSS remains modest at 0.89% (76th percentile) and it is not listed in CISA KEV. With CVSS 4.0 of 8.9 and no authentication required, any attacker reaching the device's web interface can gain full control.

Technical ContextAI

The affected component is the cstecgi.cgi binary that TOTOLINK devices use as a central CGI dispatcher for their web management interface; requests are routed to internal handler functions by a 'topicurl'/mode style parameter. The setWiFiAclRules handler processes the WiFi MAC access-control list configuration and passes the attacker-controlled 'mode' argument into a system-level shell call without adequate sanitization. This is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw: shell metacharacters injected into the argument are interpreted by the underlying command interpreter, allowing command chaining. CPE cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:* identifies the A8000RU application/firmware as affected. These SOHO routers typically run BusyBox/Linux with services executing as root, so injected commands generally run with root privileges.

RemediationAI

No vendor-released patch or fixed firmware version is identified in the available data at time of analysis, so remediation must rely on compensating controls. Restrict access to the device's web management interface: ensure remote/WAN-side administration is disabled so the /cgi-bin/cstecgi.cgi endpoint is unreachable from the Internet, and place the router's management interface on a trusted management VLAN or restrict it to specific admin hosts via ACLs - the trade-off is reduced convenience for remote management. Because the injection targets the setWiFiAclRules WiFi ACL handler, limit who can reach the LAN-side admin panel (strong unique admin credentials, disable UPnP-based exposure). Monitor the vendor site (https://www.totolink.net/) for an updated firmware release for the A8000RU, and if this model is end-of-life or unpatched, plan replacement with a supported router. Consult the disclosure at https://vuldb.com/vuln/359738 and exploit write-up at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_314/README.md for indicators.