CVE-2026-7139
Published: 27 April 2026
Summary
CVE-2026-7139 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A flaw has been identified in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The issue resides in the setWiFiAclRules function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component. Improper handling of the mode argument enables OS command injection, corresponding to CWE-77 and CWE-78. The vulnerability is remotely exploitable without authentication and carries a CVSS 4.0 score of 8.9.
An attacker can send a crafted HTTP request to the CGI endpoint to inject and execute arbitrary operating system commands on the device. Public exploit code has been released, allowing unauthenticated remote actors to achieve full control over the affected router, including potential persistence or lateral movement within the local network.
The EPSS score remains low, with a current value of 0.0122 and a peak of 0.0125, indicating limited observed exploitation interest to date. No vendor advisory or patch information is detailed in the available references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25878
Vulnerability details
A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mode causes os command injection. The attack is possible to be…
more
carried out remotely. The exploit has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote OS command injection in a public-facing router web CGI interface (T1190: Exploit Public-Facing Application), directly enabling arbitrary Unix shell command execution (T1059.004) on the device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the untrusted 'mode' argument passed to setWiFiAclRules, blocking the OS command injection at the CGI handler.
Enforces authorization checks before any unauthenticated remote caller can invoke the vulnerable CGI function, eliminating the attack surface.
Boundary protection can restrict or filter remote HTTP access to the router's management CGI endpoint, limiting exposure of the injection flaw.