by Kastro
Paper/Archive/CVE-2026-7156

CVE-2026-7156

Totolink A8000RU — Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection

EPSS 2%public exploitCVSS 9.8
critical.is priorityof 100
55
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 78.3.783 × 2015.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument HTTP results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.

Affected

ProductAffectedFixed inSource
A8000RU7.1cu.643_b20200521–CNA

Scores by source

VulDB (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

writeupvuldb.com/vuln/359755refvuldb.com/vuln/359755/ctiwriteupvuldb.com/submit/801142exploitgithub.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_320/README.mdreftotolink.net