Cyber Resilience

CVE-2026-7136

HighRCE

Published: 27 April 2026

Published
27 April 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score v4 8.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0177 75.3th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-7136 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

A weakness has been identified in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The issue resides in the setDmzCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the wanIdx argument enables operating system command injection. The vulnerability is tracked under CVE-2026-7136 with a CVSS 4.0 score of 8.9 and is associated with CWE-77 and CWE-78.

The flaw can be exploited remotely by unauthenticated attackers over the network without user interaction, allowing them to execute arbitrary operating system commands on the device. Public exploit code has been released, increasing the potential for automated or targeted attacks against exposed routers.

The provided references consist primarily of vulnerability disclosure entries and a proof-of-concept repository, with no specific mitigation guidance or patch details from the vendor. The associated EPSS scores remain low, moving only from 0.0122 to a peak of 0.0125.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wanIdx can lead to os command injection. The…

more

attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

The vulnerability is a command injection in a public-facing CGI web interface (T1190: Exploit Public-Facing Application), enabling unauthenticated remote OS command execution on the router's likely Unix-based OS (T1059.004: Unix Shell).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-7204Shared CWE-77, CWE-78
CVE-2026-2152Shared CWE-77, CWE-78
CVE-2026-5677Shared CWE-77, CWE-78
CVE-2026-2157Shared CWE-77, CWE-78
CVE-2026-7121Shared CWE-77, CWE-78
CVE-2026-9387Shared CWE-77, CWE-78
CVE-2026-9477Shared CWE-77, CWE-78
CVE-2026-2063Shared CWE-77, CWE-78
CVE-2026-2847Shared CWE-77, CWE-78
CVE-2026-9458Shared CWE-77, CWE-78

Affected Assets

Totolink
A8000RU
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly blocks manipulation of the wanIdx argument in setDmzCfg before it reaches the OS command interpreter.

prevent

Enforces access restrictions on the /cgi-bin/cstecgi.cgi endpoint so unauthenticated remote callers cannot invoke the vulnerable function.

prevent

Boundary-protection rules can deny external network access to the router's management CGI interface, limiting remote exploit reach.

References