CVE-2026-7156
Remote OS Command Injection in Totolink A8000RU CGI Handler
Publication date: 2026-04-27
Last updated on: 2026-04-27
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a8000ru | 7.1cu.643_b20200521 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Totolink A8000RU device, specifically in the CGI Handler component's CsteSystem function located in the /cgi-bin/cstecgi.cgi file. It involves the manipulation of the HTTP argument, which leads to an operating system command injection. This means an attacker can remotely execute arbitrary commands on the affected device.
How can this vulnerability impact me? :
The vulnerability allows remote attackers to execute arbitrary operating system commands on the affected device without any authentication or user interaction. This can lead to full compromise of the device, including unauthorized access, data theft, disruption of services, or further attacks within the network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows remote OS command injection in the Totolink A8000RU device, which can lead to unauthorized access and control over the affected system.
Such unauthorized access and potential data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure system operations.
Exploitation of this vulnerability could result in breaches of confidentiality, integrity, and availability of data, thereby violating regulatory requirements.