CVE-2026-7152: Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection
A vulnerability was identified in Totolink A8000RU 7.1cu.643b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument telnetenabled leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable Telnet by setting telnet_enabled to disabled to prevent the os command injection reachable via setTelnetCfg in /cgi-bin/cstecgi.cgi.
Totolink A8000RU CGI Handler (/cgi-bin/cstecgi.cgi) setTelnetCfg telnet_enabled = disable - Compensating control
Restrict network access to the router/CGI endpoint (e.g., block WAN access to /cgi-bin/cstecgi.cgi) since the vulnerability can be launched remotely.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7152?
CVE-2026-7152 is classified as a high severity vulnerability due to its potential for remote code execution through command injection.
How do I fix CVE-2026-7152?
To fix CVE-2026-7152, update the Totolink A8000RU to the latest firmware version that addresses this vulnerability.
What component is affected by CVE-2026-7152?
CVE-2026-7152 affects the CGI Handler component, specifically the setTelnetCfg function in the cstecgi.cgi file.
What type of attack can be executed using CVE-2026-7152?
CVE-2026-7152 allows attackers to execute remote operating system commands through command injection.
Is there a workaround for CVE-2026-7152?
Currently, the best workaround for CVE-2026-7152 is to disable Telnet access if it is not required until a patch is applied.