CVE-2026-7153: Critical OS Command Injection in Totolink A8000RU Routers

title: CVE-2026-7153: OS Command Injection via setMiniuiHomeInfoShow in Totolink Router
id: scw-2026-04-27-ai-1
status: experimental
level: critical
description: |
  Detects attempts to exploit CVE-2026-7153 by targeting the setMiniuiHomeInfoShow function in Totolink A8000RU routers. The rule looks for specific URI paths and query parameters indicative of command injection attempts, specifically targeting the 'sys_info' argument with common command injection characters like spaces, '&&', and ';', and common commands like 'ping'.
author: SCW Feed Engine (AI-generated)
date: 2026-04-27
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7153/
tags:
  - attack.execution
  - attack.t1059.004
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/cgi-bin/cstecgi.cgi'
      cs-uri-query|contains:
          - 'setMiniuiHomeInfoShow'
      cs-uri-query|contains:
          - 'sys_info='
      cs-uri-query|contains:
          - 'ping'
      cs-uri-query|contains:
          - ' ' 
      cs-uri-query|contains:
          - '&&'
      cs-uri-query|contains:
          - ';'
  condition: cs-uri AND cs-uri-query
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse