Cyber Posture

CVE-2026-7136

Critical

Published: 27 April 2026

Published
27 April 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0125 79.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wanIdx can lead to os command injection. The…

more

attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

SI-10 requires validation of untrusted inputs like the wanIdx argument to the setDmzCfg CGI function, directly preventing OS command injection.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates timely remediation of identified flaws, including patching the command injection vulnerability in the Totolink A8000RU firmware.

RA-5 Vulnerability Monitoring and Scanning good match
preventdetect

RA-5 requires vulnerability scanning and monitoring to identify and remediate the publicly disclosed OS command injection in the router's CGI handler.

Security SummaryAI

CVE-2026-7136 is an OS command injection vulnerability (CWE-77, CWE-78) affecting the Totolink A8000RU router on firmware version 7.1cu.643_b20200521. The flaw resides in the setDmzCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where manipulation of the wanIdx argument enables arbitrary command execution.

The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), rated as network-accessible with low attack complexity, no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Remote, unauthenticated attackers can exploit it over the network to inject and execute operating system commands on the device.

VulDB advisories (vuldb.com/vuln/359735) document the issue, including CTI details, while a proof-of-concept exploit is publicly hosted on GitHub (github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_311/README.md). Practitioners should monitor the Totolink website (totolink.net) for firmware updates or mitigation guidance.

The exploit has been disclosed publicly and could be leveraged for real-world attacks on unpatched devices.

Details

CWE(s)
CWE-77CWE-78

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

The vulnerability is a command injection in a public-facing CGI web interface (T1190: Exploit Public-Facing Application), enabling unauthenticated remote OS command execution on the router's likely Unix-based OS (T1059.004: Unix Shell).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References