Description
A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument HTTP leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Published: 2026-04-27
Score: 9.3 Critical
EPSS: 1.3% Low
KEV: No
Impact: Remote code execution via OS command injection
Action: Patch Immediately
AI Analysis

Impact

The vulnerability resides in the CsteSystem function of the /cgi-bin/cstecgi.cgi CGI handler on Totolink A8000RU firmware 7.1cu.643_b20200521. By manipulating request arguments, an attacker can inject and execute operating‑system commands. A successful exploit enables remote execution of arbitrary commands, compromising the router’s confidentiality, integrity and availability.

Affected Systems

Affected systems are Totolink A8000RU routers running firmware 7.1cu.643_b20200521 or earlier versions that include the vulnerable CGI handler.

Risk and Exploitability

With a CVSS score of 9.3 the flaw is considered critical. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the public disclosure and remote attack vector raise the likelihood of exploitation. Attackers can trigger the flaw over HTTP from outside the local network.

Generated by OpenCVE AI on April 28, 2026 at 04:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the router firmware to a revision that removes the vulnerable CGI handler or replaces the CsteSystem function.
  • If a firmware update is unavailable, block external access to the /cgi-bin/cstecgi.cgi endpoint or disable remote HTTP management entirely until a fix is released.
  • Limit remote management to trusted IP addresses or internal networks using firewall rules or access‑control lists.
  • Monitor router logs for anomalous CGI requests or unexpected command injection attempts, and alert administrators if such activity is detected.

Generated by OpenCVE AI on April 28, 2026 at 04:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Apr 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a8000ru
Vendors & Products Totolink a8000ru

Mon, 27 Apr 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 27 Apr 2026 17:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument HTTP leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Title Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection
First Time appeared Totolink
Totolink a8000ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a8000ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a8000ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A8000ru A8000ru Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-27T17:38:04.611Z

Reserved: 2026-04-26T19:30:14.874Z

Link: CVE-2026-7140

cve-icon Vulnrichment

Updated: 2026-04-27T17:37:42.337Z

cve-icon NVD

Status : Deferred

Published: 2026-04-27T17:16:45.467

Modified: 2026-04-27T18:35:53.583

Link: CVE-2026-7140

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T04:30:21Z

Weaknesses