Which versions of TOTOLINK A8000RU are affected by CVE-2026-7140?

TOTOLINK A8000RU routers running firmware 7.1cu.643_b20200521 are vulnerable to unauthenticated remote command execution via OS command injection, enabling complete compromise of the router and…

Is there a public PoC exploit available for CVE-2026-7140?

Yes, a public proof-of-concept exploit is available for CVE-2026-7140. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-7140?

Within 24 hours: Conduct a complete inventory of all TOTOLINK A8000RU devices currently deployed, identify which are running the vulnerable firmware version 7.1cu.643_b20200521, and immediately restrict network access to these devices by limiting administrative interface exposure and disabling remote management where operationally feasible. Within 7 days: Implement network segmentation and access controls to isolate affected routers from sensitive systems and untrusted networks; deploy enhanced logging and real-time monitoring to detect suspicious command patterns and unauthorized access attempts; and initiate vendor communication for replacement hardware and timelines. Within 30 days: Complete replacement of all vulnerable TOTOLINK A8000RU devices with vendor-supported alternatives that receive active security updates, or fully decommission affected units to eliminate the attack surface entirely.

TOTOLINK A8000RU CVE-2026-7140

Q: What is the CVSS score of CVE-2026-7140?

CVE-2026-7140 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-25879 HIGH

OS Command Injection (CWE-78)

2026-04-27 VulDB

Command Injection TOTOLINK A8000Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable command injection into a root CGI handler yields PR:N/UI:N and full C/I/A impact; scope unchanged as it affects the same OS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:50 vuln.today

PoC Detected

Apr 27, 2026 - 18:35 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 17:22 NVD

CRITICAL HIGH

CVSS changed

Apr 27, 2026 - 17:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 17:00 euvd

EUVD-2026-25879

CVE Published

Apr 27, 2026 - 16:30 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument HTTP leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

AnalysisAI

OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the HTTP argument processed by the CsteSystem function in /cgi-bin/cstecgi.cgi. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists and a POC has been disclosed; there is no public exploit identified as actively exploited in the wild (not on CISA KEV), and EPSS is low at 0.89%.

Technical ContextAI

The affected component is the CGI Handler on TOTOLINK SOHO/consumer routers, specifically the cstecgi.cgi binary that dispatches administrative and system requests to internal handler functions. The vulnerable CsteSystem function passes attacker-controlled HTTP input into an operating-system command context without adequate sanitization, matching CWE-78 (Improper Neutralization of Special Elements used in an OS Command). On these embedded MIPS/ARM Linux devices, cstecgi.cgi typically runs with root privileges, so injected shell metacharacters are executed directly by the underlying system shell. The CPE cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:* identifies the A8000RU product line as affected; the single confirmed build is 7.1cu.643_b20200521.

RemediationAI

No vendor-released patch identified at time of analysis - TOTOLINK has not published a fixed firmware version in the provided data, so monitor https://www.totolink.net/ for updated firmware superseding 7.1cu.643_b20200521 and apply it as the primary fix once released. As compensating controls, do not expose the device's web/CGI management interface to the internet: block inbound access to the HTTP/HTTPS admin ports at the network edge and restrict management to a trusted LAN segment or VPN, accepting the trade-off of losing remote administration convenience. Where feasible, place the router behind an upstream firewall and disable any remote-management/WAN-side administration feature, and consider replacing end-of-life hardware if the vendor issues no fix. Reference the disclosure at https://vuldb.com/vuln/359739 and the POC at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_315/README.md to build detection signatures for exploit traffic against /cgi-bin/cstecgi.cgi.