Which versions of TOTOLINK A8000RU are affected by CVE-2026-7152?

TOTOLINK A8000RU routers (firmware version 7.1cu.643_b20200521 or earlier) contain a remote command injection vulnerability (CVSS 8.9) enabling attackers to execute arbitrary commands and compromise…

Is there a public PoC exploit available for CVE-2026-7152?

Yes, a public proof-of-concept exploit is available for CVE-2026-7152. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-7152?

Within 24 hours, identify all TOTOLINK A8000RU routers in production through network inventory and disable remote access protocols via the device administrative interface; prioritize internet-facing instances for immediate isolation. Within 7 days, implement network segmentation to restrict access to affected routers to authorized personnel only; apply perimeter firewall rules blocking external connections and enable logging on the /cgi-bin/cstecgi.cgi endpoint. Within 30 days, replace all affected TOTOLINK A8000RU routers with alternative network equipment from vendors with current security support; prioritize replacement of internet-exposed devices.

TOTOLINK A8000RU CVE-2026-7152

Q: What is the CVSS score of CVE-2026-7152?

CVE-2026-7152 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-25914 HIGH

OS Command Injection (CWE-78)

2026-04-27 VulDB

Command Injection TOTOLINK A8000Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable CGI handler, low complexity, no user interaction; PR:N follows the reported vector though vendor auth on cstecgi.cgi should be verified; command injection yields full C/I/A compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:01 vuln.today

Severity Changed

Apr 27, 2026 - 20:22 NVD

CRITICAL HIGH

CVSS changed

Apr 27, 2026 - 20:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

PoC Detected

Apr 27, 2026 - 20:21 vuln.today

Public exploit code

EUVD ID Assigned

Apr 27, 2026 - 20:00 euvd

EUVD-2026-25914

CVE Published

Apr 27, 2026 - 19:30 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument telnet_enabled leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to inject arbitrary operating-system commands through the telnet_enabled argument of the setTelnetCfg function in /cgi-bin/cstecgi.cgi. The flaw carries a CVSS 4.0 score of 8.9 with high impact to confidentiality, integrity, and availability, and publicly available exploit code exists, though it is not listed in CISA KEV. EPSS is modest at 0.89% (76th percentile), indicating publicly available exploit code exists but no confirmation of widespread active exploitation.

Technical ContextAI

The A8000RU is a consumer/SOHO wireless router from TOTOLINK. Its web management interface routes requests through the cstecgi.cgi CGI Handler, a common single-entry-point binary used across many TOTOLINK devices that dispatches to internal handler functions by name. The vulnerable handler, setTelnetCfg, is intended to configure the device's Telnet service, but it passes the attacker-controlled telnet_enabled parameter into an OS-level command (e.g. a shell invocation to start/stop telnetd) without sanitization. This is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) issue, where shell metacharacters in the parameter break out of the intended command and execute attacker-supplied commands, typically as root on these embedded Linux devices.

RemediationAI

No vendor-released patch identified at time of analysis - no fixed firmware version is cited in the available data, and TOTOLINK has published no linked advisory. As compensating controls: disable remote (WAN-side) access to the web management interface so /cgi-bin/cstecgi.cgi is not internet-reachable, which prevents remote exploitation at the cost of losing remote administration; restrict LAN access to the admin interface to trusted management hosts/VLANs only; and disable the Telnet service and block TCP port 23 to reduce the post-exploitation foothold, accepting loss of Telnet-based management. Monitor https://www.totolink.net/ for updated firmware and apply it once a fixed build is published. Given the device's age and end-of-support risk, consider replacing the router if no patched firmware becomes available. Reference the VulDB entry (https://vuldb.com/vuln/359751) and the exploit write-up (https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_316/README.md) for detection details.