CVE-2026-7139: Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection

Published Apr 27, 2026

Updated

A flaw has been found in Totolink A8000RU 7.1cu.643b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mode causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

Affected Software

1 affected component

TOTOLINK A8000RU=7.1cu.643_b20200521

Event History

Apr 27, 2026

CVE Published

via MITRE·04:15 PM

Data Sourced

via MITRE·04:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Oct 6, 58306

Event

via FIRST·02:36 PM

Frequently Asked Questions

What is the severity of CVE-2026-7139?

CVE-2026-7139 has been identified as a critical vulnerability due to its potential for remote command execution.

How do I fix CVE-2026-7139?

To remediate CVE-2026-7139, apply the latest firmware update provided by Totolink for the A8000RU model.

What component is affected by CVE-2026-7139?

CVE-2026-7139 affects the CGI handler function setWiFiAclRules in the cstecgi.cgi file.

What types of attacks can CVE-2026-7139 enable?

CVE-2026-7139 can enable OS command injection attacks, allowing unauthorized commands to be executed on the device.

Which versions of the Totolink A8000RU are affected by CVE-2026-7139?

CVE-2026-7139 affects Totolink A8000RU version 7.1cu.643_b20200521.