Cyber Posture

CVE-2026-7203

Critical

Published: 28 April 2026

Published
28 April 2026
Modified
28 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0125 79.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be launched remotely.…

more

The exploit has been made public and could be used.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly and comprehensively prevents OS command injection by validating the manipulated 'enable' argument in the setUrlFilterRules CGI function.

SI-2 Flaw Remediation good match
prevent

Remediates the specific command injection flaw in the Totolink A8000RU firmware through timely identification, reporting, and correction.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Detects the presence of CVE-2026-7203 in the router via vulnerability scanning to enable proactive remediation.

Security SummaryAI

CVE-2026-7203 is an OS command injection vulnerability affecting the Totolink A8000RU router on firmware version 7.1cu.643_b20200521. The flaw exists in the setUrlFilterRules function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component, where manipulation of the enable argument enables command injection.

The vulnerability is exploitable remotely by unauthenticated attackers requiring no privileges, low complexity, and no user interaction, as indicated by its CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and base score of 9.8. Successful exploitation allows attackers to execute arbitrary operating system commands on the device, potentially leading to full compromise including high impacts on confidentiality, integrity, and availability.

Advisories and additional details are documented on VulDB at vuldb.com/vuln/359803 and related pages, with a public exploit available on GitHub at github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_322/README.md; the vendor site at totolink.net may provide further guidance. The exploit has been made public and could be used, with associated CWEs CWE-77 and CWE-78.

Details

CWE(s)
CWE-77CWE-78

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Unauthenticated remote OS command injection via public-facing router CGI directly enables T1190 exploitation and facilitates T1059.004 Unix Shell execution on Linux-based firmware.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References