CVE-2026-7156
Published: 27 April 2026
Summary
CVE-2026-7156 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability identified as CVE-2026-7156 affects the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. It resides in the CsteSystem function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component. The flaw stems from improper handling of the HTTP argument, enabling operating system command injection as classified under CWE-77 and CWE-78. The issue carries a CVSS 4.0 score of 8.9 and can be triggered over the network without authentication.
An unauthenticated remote attacker can supply a crafted HTTP argument to the CGI endpoint, resulting in arbitrary command execution on the device. This grants the ability to compromise the router's integrity, confidentiality, and availability. Public exploit code has been released, lowering the barrier for potential misuse.
The EPSS score remains low at 0.0122 with a peak of only 0.0125, indicating limited observed exploitation interest to date. Vendor references point to the Totolink site and public vulnerability disclosures, though no specific patch or mitigation guidance is detailed in the available records.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25923
Vulnerability details
A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument HTTP results in os command injection. The attack may be launched remotely. The…
more
exploit is now public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection via public-facing router web CGI directly enables exploitation of public-facing application (T1190) and command execution via Unix Shell (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the HTTP argument in cstecgi.cgi to block the OS command injection vector.
Enforces access control on the CGI endpoint so unauthenticated remote attackers cannot reach CsteSystem.
Restricts network traffic to the router's management interface, limiting exposure of the vulnerable /cgi-bin/cstecgi.cgi path.