Cyber Resilience

CVE-2026-7139

HighRCE

Published: 27 April 2026

Published
27 April 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score v4 8.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0177 75.3th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-7139 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

A flaw has been identified in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The issue resides in the setWiFiAclRules function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component. Improper handling of the mode argument enables OS command injection, corresponding to CWE-77 and CWE-78. The vulnerability is remotely exploitable without authentication and carries a CVSS 4.0 score of 8.9.

An attacker can send a crafted HTTP request to the CGI endpoint to inject and execute arbitrary operating system commands on the device. Public exploit code has been released, allowing unauthenticated remote actors to achieve full control over the affected router, including potential persistence or lateral movement within the local network.

The EPSS score remains low, with a current value of 0.0122 and a peak of 0.0125, indicating limited observed exploitation interest to date. No vendor advisory or patch information is detailed in the available references.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mode causes os command injection. The attack is possible to be…

more

carried out remotely. The exploit has been published and may be used.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

The vulnerability is an unauthenticated remote OS command injection in a public-facing router web CGI interface (T1190: Exploit Public-Facing Application), directly enabling arbitrary Unix shell command execution (T1059.004) on the device.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-7204Shared CWE-77, CWE-78
CVE-2026-2152Shared CWE-77, CWE-78
CVE-2026-5677Shared CWE-77, CWE-78
CVE-2026-2157Shared CWE-77, CWE-78
CVE-2026-7136Shared CWE-77, CWE-78
CVE-2026-7121Shared CWE-77, CWE-78
CVE-2026-9387Shared CWE-77, CWE-78
CVE-2026-9477Shared CWE-77, CWE-78
CVE-2026-2063Shared CWE-77, CWE-78
CVE-2026-2847Shared CWE-77, CWE-78

Affected Assets

Totolink
A8000RU
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of the untrusted 'mode' argument passed to setWiFiAclRules, blocking the OS command injection at the CGI handler.

prevent

Enforces authorization checks before any unauthenticated remote caller can invoke the vulnerable CGI function, eliminating the attack surface.

prevent

Boundary protection can restrict or filter remote HTTP access to the router's management CGI endpoint, limiting exposure of the injection flaw.

References