CVE-2026-7154
Published: 27 April 2026
Summary
CVE-2026-7154 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-7 (Boundary Protection).
Deeper analysis
A weakness has been identified in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The issue resides in the setAdvancedInfoShow function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component and stems from improper handling of the tty_server argument, enabling OS command injection. The vulnerability is remotely exploitable without authentication and carries a CVSS 4.0 score of 8.9, with associated CWEs 77 and 78.
An attacker can send a crafted HTTP request to the affected CGI endpoint to inject and execute arbitrary operating system commands on the device. Because the attack requires no user interaction or credentials and the exploit code has been published publicly, unauthenticated remote adversaries can leverage it to compromise the router's confidentiality, integrity, and availability.
The EPSS score has remained low and essentially flat, moving only from 0.0122 to a peak of 0.0125, indicating limited observed exploitation interest to date. Public references include a detailed proof-of-concept on GitHub along with entries on VulDB, but no vendor advisory or patch information is provided in the available sources.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25918
Vulnerability details
A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument tty_server can lead to os command injection. The attack can be…
more
launched remotely. The exploit has been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated OS command injection in a public-facing router web CGI interface (T1190: Exploit Public-Facing Application), directly enabling arbitrary Unix shell command execution (T1059.004: Unix Shell).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the tty_server argument in setAdvancedInfoShow to block OS command injection via the unauthenticated CGI endpoint.
Restricts remote network access to the router's management CGI interface, reducing the attack surface for unauthenticated command-injection attempts.
Mandates timely patching or firmware updates to eliminate the publicly disclosed command-injection flaw in /cgi-bin/cstecgi.cgi.