CVE-2026-7156
Received Received - Intake
Remote OS Command Injection in Totolink A8000RU CGI Handler

Publication date: 2026-04-27

Last updated on: 2026-04-27

Assigner: VulDB

Description
A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument HTTP results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-27
Last Modified
2026-04-27
Generated
2026-06-16
AI Q&A
2026-04-28
EPSS Evaluated
2026-06-15
NVD
CVE-2026-7156
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
totolink a8000ru 7.1cu.643_b20200521
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Totolink A8000RU device, specifically in the CGI Handler component's CsteSystem function located in the /cgi-bin/cstecgi.cgi file. It involves the manipulation of the HTTP argument, which leads to an operating system command injection. This means an attacker can remotely execute arbitrary commands on the affected device.

Impact Analysis

The vulnerability allows remote attackers to execute arbitrary operating system commands on the affected device without any authentication or user interaction. This can lead to full compromise of the device, including unauthorized access, data theft, disruption of services, or further attacks within the network.

Compliance Impact

This vulnerability allows remote OS command injection in the Totolink A8000RU device, which can lead to unauthorized access and control over the affected system.

Such unauthorized access and potential data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure system operations.

Exploitation of this vulnerability could result in breaches of confidentiality, integrity, and availability of data, thereby violating regulatory requirements.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7156. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart