Totolink A8000RU Faces Critical Remote Command Injection (CVE-2026-7155)

A critical security vulnerability, identified as CVE-2026-7155, has been disclosed in Totolink A8000RU firmware version 7.1cu.643_b20200521. This flaw resides within the setLoginPasswordCfg function of the /cgi-bin/cstecgi.cgi component, specifically through the manipulation of the admpass argument. The National Vulnerability Database attributes this to an OS command injection, a dangerous class of vulnerability often leading to full system compromise.

This is a severe issue. National Vulnerability Database has assigned CVE-2026-7155 a CVSSv3.1 score of 9.8 (CRITICAL), indicating that it is easily exploitable remotely without authentication (AV:N, PR:N, UI:N). The public disclosure of an exploit further raises the alarm. Attackers can leverage this to execute arbitrary commands on affected devices, potentially gaining complete control over the router and, by extension, the network it manages. This translates directly to network persistence, data exfiltration, or launching further attacks from within the victim’s infrastructure.

For defenders, this means any Totolink A8000RU devices running the specified firmware are effectively wide open. The attacker’s calculus is straightforward: find these devices, exploit the publicly available proof-of-concept, and gain a foothold. This isn’t theoretical; it’s a direct threat that needs immediate attention. Command injection vulnerabilities are a gift for adversaries, offering a low-effort path to high-impact results, aligning with CWE-77 and CWE-78.