embedded-device-vulnerabilityproof-of-concept-releaseperimeter-device-exposureinternet-facing-service-vulnerability

Critical Command Injection Flaws Expose Totolink A7100RU and A8000RU Routers

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Apr 9, 2026

Two Totolink router models, A7100RU and A8000RU, were disclosed with critical OS command injection vulnerabilities in the CGI handler endpoint /cgi-bin/cstecgi.cgi. The flaws affect the setVpnPassCfg function and stem from improper handling of the pptpPassThru argument, allowing attackers to inject operating system commands remotely. The issues were assigned CVE-2026-5850 for the A7100RU running firmware 7.4cu.2313_b20191024 and CVE-2026-7037 for the A8000RU running firmware 7.1cu.643_b20200521.

Both vulnerabilities are classified under CWE-78 and CWE-77, and were reported as remotely exploitable without privileges or user interaction. The disclosures indicate that public exploits are available, materially raising the risk of opportunistic compromise of exposed devices. Severity scoring across CVSS v2, CVSS v3.1, and CVSS v4.0 places the flaws at critical or maximum-impact levels, making internet-facing Totolink routers running the affected firmware high-priority targets for remediation or isolation.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Apr 9, 2026 – Apr 26, 2026

Apr 26, 20266mo ago
Public exploit noted for CVE-2026-7037
The CVE-2026-7037 entry stated that a public exploit had been released for the Totolink A8000RU vulnerability, increasing the likelihood of real-world attacks.
Apr 26, 20266mo ago
CVE-2026-7037 disclosed for Totolink A8000RU command injection
A CVE entry was recorded for a remote OS command injection vulnerability in Totolink A8000RU firmware 7.1cu.643_b20200521. The flaw affects the setVpnPassCfg function in /cgi-bin/cstecgi.cgi through the pptpPassThru argument and was classified as remotely exploitable.
Apr 9, 20267mo ago
Public exploit noted for CVE-2026-5850
The CVE-2026-5850 record indicated that a public exploit was available for the Totolink A7100RU command injection vulnerability, raising the risk of exploitation.
Apr 9, 20267mo ago
CVE-2026-5850 disclosed for Totolink A7100RU command injection
A CVE entry for a remote OS command injection flaw in Totolink A7100RU firmware 7.4cu.2313_b20191024 was received by VulDB. The issue affects the setVpnPassCfg function in /cgi-bin/cstecgi.cgi via the pptpPassThru argument and was reported as remotely exploitable without privileges or user interaction.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

OS Command Injection in Totolink A7100RU setVpnPassCfg (CVE-2026-5850)OS Command Injection in Totolink A8000RU setVpnPassCfg (CVE-2026-7037)

Affected products

1 linked

A7100ru

Organizations

1 linked

Totolink

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Apr 26, 2026

CVE-2026-7037 - Totolink A8000RU CGI cstecgi.cgi setVpnPassCfg os command injectionOpen source ↗

Cvefeed High SeverityAdvisories · Apr 9, 2026

CVE-2026-5850 - Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injectionOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Critical Command Injection Flaws Expose Totolink A7100RU and A8000RU Routers

How this story unfolded

Public exploit noted for CVE-2026-7037

CVE-2026-7037 disclosed for Totolink A8000RU command injection

Public exploit noted for CVE-2026-5850

CVE-2026-5850 disclosed for Totolink A7100RU command injection

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical Command Injection Flaws Expose Totolink A8000RU Routers to Remote RCE

Publicly Exploitable Command Injection Flaws Disclosed in Totolink A3300R Router

Unauthenticated Command Injection Flaws Disclosed in Totolink A7100RU Router

Critical Command Injection Flaws Expose Totolink A7100RU and A8000RU Routers

How this story unfolded

Public exploit noted for CVE-2026-7037

CVE-2026-7037 disclosed for Totolink A8000RU command injection

Public exploit noted for CVE-2026-5850

CVE-2026-5850 disclosed for Totolink A7100RU command injection

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Critical Command Injection Flaws Expose Totolink A8000RU Routers to Remote RCE

Publicly Exploitable Command Injection Flaws Disclosed in Totolink A3300R Router

Unauthenticated Command Injection Flaws Disclosed in Totolink A7100RU Router