CVE-2026-7240
Published: 28 April 2026
Summary
CVE-2026-7240 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A8000RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A vulnerability has been identified in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The issue resides in the setVpnAccountCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the User argument enables operating system command injection. The flaw is tracked under CVE-2026-7240 and carries a CVSS 4.0 score of 8.9, reflecting network-accessible command injection weaknesses classified as CWE-77 and CWE-78.
Remote, unauthenticated attackers can exploit the vulnerability by sending crafted requests to the affected CGI endpoint, allowing arbitrary operating system commands to be executed on the device. Successful exploitation can result in full control over the router, with impacts to confidentiality, integrity, and availability. A public exploit for this issue has already been disclosed.
The current EPSS score stands at 0.0122 with a recorded peak of 0.0125, indicating limited but documented exploitation interest following public disclosure. Vendor references point to the Totolink support site and detailed vulnerability reports that include proof-of-concept material.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26010
Vulnerability details
A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument User leads to os command injection. The attack can be executed…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote OS command injection in the public-facing CGI web interface of a router, directly enabling exploitation of a public-facing application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of the User argument passed to setVpnAccountCfg, directly blocking the OS command injection vector in /cgi-bin/cstecgi.cgi.
Mandates timely application of vendor patches to eliminate the publicly disclosed command-injection flaw in firmware 7.1cu.643_b20200521.
Enforces access-control checks on the CGI endpoint so that unauthenticated remote requests cannot reach setVpnAccountCfg.