CVE-2026-7137
Published: 27 April 2026
Summary
CVE-2026-7137 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
A security vulnerability has been detected in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The issue resides in the setStorageCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the sambaEnabled argument enables operating system command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9, reflecting network-accessible attack conditions without authentication or user interaction.
An unauthenticated remote attacker can supply a crafted request to the CGI endpoint to inject and execute arbitrary operating system commands on the device. Successful exploitation grants full control over the affected router, allowing actions such as data exfiltration, configuration changes, or use of the device as a pivot point within the network. Publicly available exploit code has been disclosed, confirming the attack vector is practical.
The EPSS score remains low, moving only from 0.0122 to a peak of 0.0125, indicating limited observed exploitation interest to date. Reference materials point to a detailed proof-of-concept on GitHub and entries in the VulDB database, while the vendor site provides no immediate mitigation guidance in the listed sources.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25875
Vulnerability details
A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument sambaEnabled leads to os command injection. Remote exploitation of the attack…
more
is possible. The exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated OS command injection via public-facing router web CGI directly enables T1190 (Exploit Public-Facing Application) for initial access and facilitates T1059.004 (Unix Shell) for arbitrary command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted input (sambaEnabled) to the CGI handler, blocking the OS command injection vector at its root.
Enforces authentication and authorization checks before any CGI function (setStorageCfg) can be invoked, eliminating the unauthenticated remote exploitation path.
Restricts network access to the router's management CGI endpoint from untrusted zones, reducing the attack surface for remote command injection.