CVE-2026-7138: Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection
A vulnerability was detected in Totolink A8000RU 7.1cu.643b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument tz results in os command injection. The attack can be executed remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7138?
CVE-2026-7138 is a high severity vulnerability that allows for OS command injection through the setNtpCfg function.
How do I fix CVE-2026-7138?
To fix CVE-2026-7138, update your Totolink A8000RU to the latest firmware version that addresses this vulnerability.
What is the impact of CVE-2026-7138 on my system?
The impact of CVE-2026-7138 is that it can allow an attacker to execute arbitrary commands on the affected device.
Which version of Totolink A8000RU is affected by CVE-2026-7138?
CVE-2026-7138 affects the Totolink A8000RU version 7.1cu.643_b20200521.
What component is involved in the CVE-2026-7138 vulnerability?
The CVE-2026-7138 vulnerability involves the CGI Handler component and specifically the cstecgi.cgi file.