Which versions of TOTOLINK A8000RU are affected by CVE-2026-7156?

TOTOLINK A8000RU routers (firmware 7.1cu.643_b20200521) contain a critical vulnerability enabling remote attackers to gain unauthorized administrative control without credentials.

How to fix or mitigate CVE-2026-7156?

Within 24 hours, identify and inventory all TOTOLINK A8000RU routers running firmware version 7.1cu.643_b20200521 or earlier, then immediately isolate affected devices from critical systems using network segmentation or firewall rules. Within 7 days, deploy firewall rules blocking HTTP access to /cgi-bin/cstecgi.cgi on all routers, enable enhanced logging of administrative access and CGI requests, and contact TOTOLINK support to confirm whether any patched firmware alternatives are available. Within 30 days, develop and execute a device replacement strategy for all vulnerable units, migrate to alternative router hardware with active vendor support, and complete retirement of affected equipment from production networks.

TOTOLINK A8000RU CVE-2026-7156

Q: What is the CVSS score of CVE-2026-7156?

CVE-2026-7156 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-25923 HIGH

Command Injection (CWE-77)

2026-04-27 cna@vuldb.com

Command Injection

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable CGI endpoint requiring no auth or interaction (AV:N/AC:L/PR:N/UI:N); command injection yields full command execution on the device, so C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:57 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 21:22 euvd

EUVD-2026-25923

CVE Published

Apr 27, 2026 - 21:16 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument HTTP results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

OS command injection in TOTOLINK A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating-system commands via the CsteSystem function in /cgi-bin/cstecgi.cgi. Attacker-controlled input passed through the CGI Handler's HTTP argument is concatenated into a system command without sanitization. Publicly available exploit code exists (SSVC exploitation status: poc); there is no public exploit identified as being used in active attacks, and EPSS is modest at 0.89% (76th percentile).

Technical ContextAI

The affected component is the cstecgi.cgi binary, the central CGI request handler used across many TOTOLINK SOHO routers to process web-management and API requests. The vulnerable CsteSystem function is a wrapper that ultimately invokes a shell (system()/popen-style execution) on the embedded Linux/BusyBox environment. Because an attacker-supplied HTTP parameter is passed into this shell call without validation or escaping, shell metacharacters (;, |, &, backticks, $()) break out of the intended command context. This maps to CWE-77 (Improper Neutralization of Special Elements used in a Command), the classic command-injection root cause endemic to TOTOLINK's cstecgi.cgi across numerous CVEs. No CPE strings were provided in the input; affected product identification rests on the EUVD/NVD version string 'A8000RU 7.1cu.643_b20200521'.

RemediationAI

No vendor-released patch identified at time of analysis - TOTOLINK has not published a fixed firmware version for CVE-2026-7156, so no exact upgrade target can be cited. As compensating controls, disable remote/WAN-side access to the web management interface so /cgi-bin/cstecgi.cgi is unreachable from the internet (trade-off: eliminates remote administration convenience), and restrict LAN access to the management interface to a trusted admin host or VLAN via firewall/ACL rules (trade-off: complicates legitimate multi-device management). Where feasible, place the device behind a separate firewall that blocks inbound HTTP/HTTPS to the router's management port, and monitor for anomalous cstecgi.cgi requests containing shell metacharacters. Given TOTOLINK's history of unpatched or slowly-patched embedded flaws, consider replacing end-of-life A8000RU units if no firmware update materializes. Track vendor updates at https://www.totolink.net/ and the VulDB entry https://vuldb.com/vuln/359755.