CVE-2026-7138
Published: 27 April 2026
Summary
CVE-2026-7138 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
A vulnerability was detected in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. It resides in the setNtpCfg function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component, where improper handling of the tz argument permits OS command injection. The issue is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9.
The flaw can be exploited remotely by unauthenticated attackers who supply a malicious tz value to the CGI endpoint, resulting in arbitrary command execution on the device with impacts to confidentiality, integrity, and availability. A public exploit is available that demonstrates the attack.
The EPSS score remains low, with a current value of 0.0122 and a peak of 0.0125, indicating limited observed exploitation interest to date. The vendor site and public disclosure repositories provide additional technical details but do not describe available patches or configuration mitigations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25876
Vulnerability details
A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument tz results in os command injection. The attack can be executed remotely.…
more
The exploit is now public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote attackers can exploit the public-facing CGI web interface (T1190) to perform OS command injection, enabling arbitrary Unix shell command execution (T1059.004) on the router.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandatory validation and sanitization of the tz argument in setNtpCfg would directly block the malicious input that produces OS command injection via cstecgi.cgi.
Access enforcement on the CGI endpoint would require authentication and authorization before any tz value could be processed, preventing unauthenticated remote exploitation.
Boundary protection (e.g., firewall rules or WAF filtering) can restrict or inspect traffic to /cgi-bin/cstecgi.cgi and drop requests containing command-injection payloads in the tz parameter.