CVE-2026-7152
Published: 27 April 2026
Summary
CVE-2026-7152 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability has been identified in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. It resides in the setTelnetCfg function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component, where improper handling of the telnet_enabled argument permits OS command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9.
The vulnerability can be exploited remotely by unauthenticated attackers who supply crafted input to the affected CGI endpoint, enabling execution of arbitrary operating system commands on the device. A publicly available exploit exists that demonstrates this vector.
The EPSS score remains low, moving only from 0.0122 to a peak of 0.0125 with no material increase after disclosure. References point to a detailed proof-of-concept on GitHub and entries on VulDB, along with the vendor site, but contain no further details on patches or mitigations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25914
Vulnerability details
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument telnet_enabled leads to os command injection. It is possible to launch…
more
the attack remotely. The exploit is publicly available and might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection via public-facing router web CGI directly enables exploitation of public-facing application (T1190) and facilitates arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the telnet_enabled argument in setTelnetCfg to block OS command injection via the CGI endpoint.
Enforces access control decisions on the /cgi-bin/cstecgi.cgi handler so that unauthenticated remote actors cannot reach or invoke the vulnerable function.
Restricts remote network access to the router's management CGI interface, limiting exposure of the command-injection flaw to only authorized management paths.