Which versions of TOTOLINK A8000RU are affected by CVE-2026-7153?

TOTOLINK A8000RU routers running firmware 7.1cu.643_b20200521 are vulnerable to unauthenticated remote code execution, enabling attackers to seize complete control of your network infrastructure…

Is there a public PoC exploit available for CVE-2026-7153?

Yes, a public proof-of-concept exploit is available for CVE-2026-7153. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-7153?

Within 24 hours, conduct an urgent inventory of all deployed TOTOLINK A8000RU devices and confirm which are running firmware 7.1cu.643_b20200521; immediately isolate any affected units from production networks if possible, or restrict administrative access to trusted subnets only via firewall ACLs. Within 7 days, contact TOTOLINK support to verify patch timeline and replacement options; apply any available firmware updates immediately upon release, and implement strict network segmentation preventing these devices from accessing sensitive systems if compromise occurs. Within 30 days, establish a phased replacement roadmap for affected models and complete deployment of substitute equipment, or implement compensating controls including 24/7 network monitoring for exploitation attempts and mandatory administrative session logging for all router access.

TOTOLINK A8000RU CVE-2026-7153

Q: What is the CVSS score of CVE-2026-7153?

CVE-2026-7153 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-25915 HIGH

OS Command Injection (CWE-78)

2026-04-27 VulDB

Command Injection TOTOLINK A8000Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable CGI parameter injection with no interaction and, per the supplied vector, no auth (PR:N); command execution as root yields full C/I/A impact with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:00 vuln.today

Severity Changed

Apr 27, 2026 - 20:22 NVD

CRITICAL HIGH

CVSS changed

Apr 27, 2026 - 20:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

PoC Detected

Apr 27, 2026 - 20:21 vuln.today

Public exploit code

EUVD ID Assigned

Apr 27, 2026 - 20:00 euvd

EUVD-2026-25915

CVE Published

Apr 27, 2026 - 19:45 nvd

HIGH 8.9

DescriptionCVE.org

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sys_info results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the sys_info argument passed to the setMiniuiHomeInfoShow function of /cgi-bin/cstecgi.cgi. Per the CVSS vector the attack is network-based with no privileges or user interaction required (PR:N/UI:N), and publicly available exploit code exists (published via VulDB/GitHub), though it is not listed in CISA KEV. EPSS is low at 0.89% (76th percentile), suggesting exploitation is plausible but not yet widespread.

Technical ContextAI

The vulnerable component is the cstecgi.cgi CGI Handler, the common request dispatcher used across TOTOLINK's Realtek/MIPS-based SOHO router firmware. The setMiniuiHomeInfoShow handler consumes an attacker-controllable parameter (sys_info) and, per CWE-78 (Improper Neutralization of Special Elements used in an OS Command), passes it into a shell/system call without adequate sanitization, so shell metacharacters break out of the intended command context. Because embedded router web daemons typically run as root, injected commands generally execute with full device privileges. The single affected artifact identified by CPE is cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:* on the firmware build 7.1cu.643_b20200521.

RemediationAI

No vendor-released patch or fixed firmware version was identified at time of analysis, so the primary action is to obtain updated firmware from TOTOLINK (https://www.totolink.net/) and monitor for a fixed build superseding 7.1cu.643_b20200521. Until a patch is confirmed, apply compensating controls: remove the router's web/management interface (the cstecgi.cgi endpoint) from WAN/internet exposure and restrict it to a trusted management VLAN or specific admin hosts - this blocks the remote network vector at the cost of remote administration convenience; place the device behind a firewall that filters access to /cgi-bin/cstecgi.cgi; and change default credentials plus enable any available session controls to raise the bar if authentication is in fact enforced. Given the device is likely end-of-support consumer hardware, replacing it with a currently-supported router is the most durable mitigation. Advisory/exploit references: https://vuldb.com/vuln/359752 and the public POC at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_317/README.md .