CVE-2026-7137

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument sambaEnabled leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
Totolink	A8000RU	7.1cu.643_b20200521

References

Timeline

Published: Apr 27, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-713749.8Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from CVE-2026-713757.4Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Compon CVE-2026-713769.8OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 befo CVE-2026-713779.8Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-0 CVE-2026-713784.6ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource CVE-2026-7137910.0The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.CVE-2026-71389.8A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-bin CVE-2026-713808.7Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to ca CVE-2026-713814.0Adobe Genuine Software Integrity Service on Windows is affected by an Incorrect Authorization vulnerability that could result in a Security CVE-2026-713827.8Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th CVE-2026-713837.3is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vuln CVE-2026-713849.6is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vuln