CVE-2026-7203
Published: 28 April 2026
Summary
CVE-2026-7203 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability in the Totolink A8000RU router firmware version 7.1cu.643_b20200521 allows OS command injection through the setUrlFilterRules function in the /cgi-bin/cstecgi.cgi CGI handler. The flaw is triggered by unsanitized input to the enable argument and is tracked under CWE-77 and CWE-78. It carries a CVSS 4.0 score of 8.9 and can be reached over the network without authentication.
An unauthenticated remote attacker can send a crafted HTTP request to the CGI endpoint and execute arbitrary operating-system commands on the device. Public exploit code for this issue has already been released, enabling attackers to gain full control of the router’s operating environment, including the ability to alter network traffic or persist on the device.
The EPSS score remains low at 0.0122 with a peak of only 0.0125, indicating limited observed exploitation interest since disclosure. No vendor advisory or firmware update addressing the issue is referenced in the available sources.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25960
Vulnerability details
A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be launched remotely.…
more
The exploit has been made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection via public-facing router CGI directly enables T1190 exploitation and facilitates T1059.004 Unix Shell execution on Linux-based firmware.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the 'enable' argument passed to setUrlFilterRules, blocking the unsanitized input that enables OS command injection.
Enforces authentication and authorization checks before any CGI handler function can be invoked, eliminating the unauthenticated remote execution path.
Restricts network access to the /cgi-bin/cstecgi.cgi endpoint from untrusted sources, limiting the attack surface for remote command injection.