Which versions of Totolink A8000RU are affected by CVE-2026-7240?

Totolik A8000RU router firmware 7.1cu.643_b20200521 contains an unauthenticated remote code execution vulnerability in its VPN configuration interface that allows attackers to execute arbitrary…

Is there a public PoC exploit available for CVE-2026-7240?

Yes, a public proof-of-concept exploit is available for CVE-2026-7240. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-7240?

Within 24 hours: Identify all Totolik A8000RU devices on your network and document firmware versions; immediately isolate any running 7.1cu.643_b20200521 from production networks or internet access. Within 7 days: Contact Totolik support for available firmware updates; if no patch exists, evaluate replacement with patched hardware or alternative vendors; verify no unauthorized access occurred on affected devices through log review and network monitoring. Within 30 days: Complete remediation of all vulnerable devices through firmware update to the latest available version or device replacement; implement network segmentation to restrict admin interfaces from direct internet exposure; deploy intrusion detection signatures for exploitation attempts against /cgi-bin/cstecgi.cgi setVpnAccountCfg.

Totolink A8000RU CVE-2026-7240

Q: What is the CVSS score of CVE-2026-7240?

CVE-2026-7240 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-26010 HIGH

OS Command Injection (CWE-78)

2026-04-28 VulDB

Command Injection A8000Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 28, 2026 - 20:24 vuln.today

Public exploit code

Analysis Updated

Apr 28, 2026 - 08:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 28, 2026 - 08:22 vuln.today

cvss_changed

Severity Changed

Apr 28, 2026 - 08:22 NVD

CRITICAL HIGH

CVSS changed

Apr 28, 2026 - 08:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

Analysis Generated

Apr 28, 2026 - 08:01 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 07:30 euvd

EUVD-2026-26010

Analysis Generated

Apr 28, 2026 - 07:30 vuln.today

CVE Published

Apr 28, 2026 - 07:15 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument User leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

OS command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the User parameter in the setVpnAccountCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (GitHub POC), enabling immediate weaponization. CVSS 8.9 with full impact on confidentiality, integrity, and availability. EPSS data unavailable; not currently in CISA KEV, but the combination of network accessibility, no authentication requirement, and public exploit makes this a critical risk for internet-facing devices.

Technical ContextAI

This vulnerability targets the CGI (Common Gateway Interface) handler of the Totolink A8000RU wireless router, specifically within the cstecgi.cgi binary that processes web-based administrative requests. The setVpnAccountCfg function, responsible for configuring VPN account settings, fails to properly sanitize the User parameter before passing it to system shell commands. This is a classic CWE-78 (OS Command Injection) flaw where special shell metacharacters in user-controlled input can break out of the intended command context and execute arbitrary commands with the privileges of the web server process, typically root on embedded devices. The vulnerability exists in firmware version 7.1cu.643_b20200521, affecting the product identified by CPE cpe:2.3:a:totolink:a8000ru. Router CGI vulnerabilities are particularly dangerous because these devices often run with elevated privileges and have direct access to network configurations, WAN interfaces, and connected LAN devices.

RemediationAI

Check the Totolink vendor website (https://www.totolink.net/) immediately for firmware updates newer than 7.1cu.643_b20200521 that address CVE-2026-7240. No vendor security advisory has been identified at time of analysis, and no patched firmware version is confirmed. If no patch is available or the product is end-of-life, implement the following compensating controls in order of effectiveness: (1) Remove the device from direct internet exposure by placing it behind a firewall that blocks inbound connections to the web management interface (typically TCP 80/443) - this eliminates remote attack vector but does not protect against LAN-based attacks; (2) Disable remote administration features entirely through the router's web interface if the functionality is not required - verify that the CGI interface is inaccessible from WAN after disabling; (3) If remote management is required, restrict access by source IP address using upstream firewall rules to only known administrator IP ranges - note this is brittle and fails if attacker spoofs or compromises allowed source. Critical limitation: these workarounds do not fix the underlying vulnerability and malicious actors on the local network can still exploit it. Long-term remediation requires replacing the device with a supported product from a vendor with an active security update program.