CVE-2026-7136: Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection

Published Apr 27, 2026

Updated

A weakness has been identified in Totolink A8000RU 7.1cu.643b20200521. Affected by this issue is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wanIdx can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

Affected Software

1 affected component

TOTOLINK A8000RU=7.1cu.643_b20200521

Event History

Apr 27, 2026

CVE Published

via MITRE·03:30 PM

Data Sourced

via MITRE·03:30 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Oct 6, 58306

Event

via FIRST·07:41 PM

Frequently Asked Questions

What is the severity of CVE-2026-7136?

CVE-2026-7136 is considered a high-severity vulnerability due to the potential for remote code execution.

How do I fix CVE-2026-7136?

To fix CVE-2026-7136, update the Totolink A8000RU to the latest firmware version provided by the vendor.

What are the consequences of CVE-2026-7136 exploitation?

Exploitation of CVE-2026-7136 allows an attacker to execute arbitrary commands on the affected device.

Which devices are affected by CVE-2026-7136?

CVE-2026-7136 affects the Totolink A8000RU running firmware version 7.1cu.643_b20200521.

How does CVE-2026-7136 execute commands?

CVE-2026-7136 allows command injection through the 'wanIdx' argument in the setDmzCfg function within the CGI handler.