Totolink A8000RU Critical Command Injection (CVE-2026-7139)

A critical vulnerability, CVE-2026-7139, has been identified in Totolink A8000RU firmware version 7.1cu.643_b20200521. This flaw, discovered in the setWiFiAclRules function within the /cgi-bin/cstecgi.cgi component’s CGI Handler, allows for remote operating system command injection. The vulnerability stems from improper handling of the mode argument.

The National Vulnerability Database (NVD) has assigned a CVSS score of 9.8 (Critical) to this issue, underscoring its severe impact. The root causes are categorized under CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Attackers can exploit this remotely, and proof-of-concept exploit code has already been published, increasing the immediacy of the threat.

This is a classic command injection scenario, allowing unauthenticated attackers to execute arbitrary commands on the affected router. Given that these devices often sit at the network edge, a successful exploit grants attackers a foothold, potentially leading to network compromise, data exfiltration, or further internal pivoting. The widespread nature of vulnerable IoT devices makes this a significant concern for both home users and small to medium-sized businesses relying on such hardware.