Skip to main content

Totolink A8000RU EUVD-2026-26470

| CVE-2026-7538 HIGH
OS Command Injection (CWE-78)
2026-05-01 VulDB
Command Injection
8.9
CVSS 4.0
Share

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

7
PoC Detected
May 01, 2026 - 15:26 vuln.today
Public exploit code
Analysis Generated
May 01, 2026 - 02:30 vuln.today
Severity Changed
May 01, 2026 - 02:22 NVD
CRITICAL HIGH
CVSS changed
May 01, 2026 - 02:22 NVD
9.8 (CRITICAL) 8.9 (HIGH)
EUVD ID Assigned
May 01, 2026 - 02:15 euvd
EUVD-2026-26470
Analysis Generated
May 01, 2026 - 02:15 vuln.today
CVE Published
May 01, 2026 - 01:30 nvd
HIGH 8.9

DescriptionNVD

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function Vulnerability of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument proto leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

OS command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'proto' parameter in /cgi-bin/cstecgi.cgi CGI handler. A public proof-of-concept exploit exists on GitHub, significantly lowering the barrier for exploitation. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: Identify and inventory all Totolik A8000RU devices running firmware version 7.1cu.643_b20200521 using network scanning tools; immediately isolate affected devices from internet-facing networks or disable remote management. Within 7 days: Contact Totolik support to confirm available firmware versions beyond 7.1cu.643_b20200521; test firmware upgrade procedures in isolated lab environment. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

EUVD-2026-26470 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy