CVE-2026-7137
OS Command Injection in Totolink A8000RU CGI Handler Allows Remote Exploit
Publication date: 2026-04-27
Last updated on: 2026-04-27
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a8000ru | 7.1cu.643_b20200521 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows remote attackers to execute arbitrary operating system commands on the affected TOTOLINK A8000RU router. Such unauthorized command execution can lead to unauthorized access, data breaches, and compromise of system integrity.
As a result, organizations using this device may face challenges in maintaining compliance with common standards and regulations such as GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.
Failure to address this vulnerability could lead to violations of these regulations due to potential data exposure or system compromise.
Can you explain this vulnerability to me?
CVE-2026-7137 is a command injection vulnerability in the TOTOLINK A8000RU router, version 7.1cu.643_b20200521. It occurs in the CGI Handler component, specifically in the function setStorageCfg within the /cgi-bin/cstecgi.cgi file. The vulnerability arises from improper handling of the 'sambaEnabled' parameter, which is passed to a system command execution function without proper sanitization.
An attacker can send a specially crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint with the 'sambaEnabled' parameter containing malicious commands. This allows the attacker to execute arbitrary operating system commands on the router remotely.
For example, by setting 'sambaEnabled' to a command like `ls>./setStorageCfg.txt`, the attacker can create files or execute other shell commands on the device, demonstrating full command execution capability.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary operating system commands on the affected TOTOLINK A8000RU router without any authentication.
- Attackers can take full control of the router, potentially altering its configuration or disrupting network services.
- They may use the compromised device as a foothold to launch further attacks within the network.
- Sensitive information stored or passing through the router could be exposed or manipulated.
- The router could be used to create persistent backdoors or to deploy malware.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint with the parameter sambaEnabled set to a command that produces a detectable effect, such as creating a file.
For example, you can test for the vulnerability by sending a POST request with sambaEnabled set to `ls>./setStorageCfg.txt`. If the file setStorageCfg.txt is created on the device, it confirms the presence of the vulnerability.
A sample command using curl to test this could be:
- curl -X POST http://[router_ip]/cgi-bin/cstecgi.cgi -d 'sambaEnabled=ls>./setStorageCfg.txt'
After running this command, check the device's filesystem for the presence of setStorageCfg.txt to confirm exploitation.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-7137 vulnerability in the TOTOLINK A8000RU router, immediate steps include restricting access to the affected device's management interface to trusted networks only, such as limiting remote access or disabling remote management if not necessary.
Additionally, monitor network traffic for suspicious requests targeting the /cgi-bin/cstecgi.cgi endpoint, especially those attempting to manipulate the sambaEnabled parameter.
If possible, apply any available firmware updates or patches from the vendor that address this vulnerability.
As a temporary workaround, consider disabling or restricting the CGI Handler component or the setStorageCfg function if the device configuration allows.