CVE-2026-7152

Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection

View on CVE.org
Published Apr 27, 2026 CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Description
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument telnet_enabled leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Analysis

AI-generated

Technical impact

An OS command injection flaw exists in the setTelnetCfg function of the /cgi-bin/cstecgi.cgi CGI handler on Totolink A8000RU routers running firmware 7.1cu.643_b20200521. The flaw allows an attacker to inject arbitrary shell commands by manipulating the telnet_enabled argument. Exploiting this vulnerability can lead to full compromise of the device, granting an attacker the ability to execute commands with the privileges of the router’s operating system.

Affected Systems

The vulnerability affects the Totolink A8000RU router, specifically firmware version 7.1cu.643_b20200521 and potentially earlier releases that have not applied the patch.

Risk and Exploitability

The CVSS score is 9.3, indicating critical severity. The EPSS score is 0.01766 %, but the public availability of the exploit and the lack of KEV listing suggest that the vulnerability is actively exploitable. Attackers can reach the vulnerable component remotely, likely over the network, and trigger command injection via the telnet_enabled parameter. Because the flaw permits arbitrary command execution without authentication, once remote access is achieved, the attacker can gain full control of the device.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the router to the latest firmware version that addresses the command‑injection flaw.
  • If a patched firmware is not immediately available, disable the Telnet service in the router’s settings to remove the vulnerable interface.
  • Configure firewall rules to block external access to /cgi-bin/cstecgi.cgi from untrusted networks or IP ranges.
  • Enable logging and monitor for suspicious command execution attempts to detect potential exploitation attempts.

Generated by OpenCVE AI on October 25, 2026 at 20:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Totolink a8000ru
Vendors & Products Totolink a8000ru
Type Values Removed Values Added
Description A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument telnet_enabled leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Title Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection
First Time appeared Totolink
Totolink a8000ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a8000ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a8000ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 28, 2026, 3:37 PM
Reserved
Apr 26, 2026, 8:08 PM

View source JSON

Updated
Apr 28, 2026, 3:37 PM

JSON

Status
Deferred
Published
Apr 27, 2026, 8:16 PM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Oct 25, 2026, 9:00 PM

JSON