CVE-2026-7152CWE-77CWE-78

Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection

Critical · published April 27, 2026

CVSS v4.0
9.3
EPSS
3%
Percentile
88.3
In the wild
Unconfirmed
What it is

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument telnet_enabled leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.03253 · 88.3th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-04-27T19:30Z
EPSS history
Timeline
  • 27 APR 19:30Z
    Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection
    cvelistv5