CVE-2026-7156: Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection
A vulnerability was detected in Totolink A8000RU 7.1cu.643b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument HTTP results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7156?
CVE-2026-7156 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-7156?
To fix CVE-2026-7156, update the Totolink A8000RU to the latest firmware version provided by the vendor.
What is the nature of the vulnerability CVE-2026-7156?
CVE-2026-7156 is an OS command injection vulnerability arising from improper handling of user input in the CGI handler.
Which devices are affected by CVE-2026-7156?
CVE-2026-7156 affects the Totolink A8000RU router running firmware version 7.1cu.643_b20200521.
Can CVE-2026-7156 be exploited remotely?
Yes, CVE-2026-7156 can be exploited remotely due to the vulnerability being accessible via the CGI handler.