{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-7153/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-7153"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["A8000RU 7.1cu.643_b20200521"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-7153","command injection","router"],"_cs_type":"advisory","_cs_vendors":["Totolink"],"content_html":"\u003cp\u003eA critical security vulnerability, identified as CVE-2026-7153, has been discovered in the Totolink A8000RU router, version 7.1cu.643_b20200521. This flaw resides within the CGI Handler component, specifically affecting the \u003ccode\u003esetMiniuiHomeInfoShow\u003c/code\u003e function located in the \u003ccode\u003e/cgi-bin/cstecgi.cgi\u003c/code\u003e file. By exploiting this vulnerability, a remote attacker can inject and execute arbitrary operating system commands on the affected device. Public exploits are available, increasing the risk of widespread exploitation. This vulnerability allows unauthenticated remote attackers to gain complete control of the device.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a vulnerable Totolink A8000RU router running firmware version 7.1cu.643_b20200521.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP request targeting the \u003ccode\u003e/cgi-bin/cstecgi.cgi\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe malicious request includes a manipulated \u003ccode\u003esys_info\u003c/code\u003e argument designed to inject an OS command into the \u003ccode\u003esetMiniuiHomeInfoShow\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe CGI Handler processes the request, and the vulnerable \u003ccode\u003esetMiniuiHomeInfoShow\u003c/code\u003e function fails to properly sanitize the \u003ccode\u003esys_info\u003c/code\u003e argument.\u003c/li\u003e\n\u003cli\u003eThe injected OS command is executed with the privileges of the web server process.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the command execution to gain further access to the system, potentially downloading malware or modifying system configurations.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes a persistent backdoor for future access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows a remote, unauthenticated attacker to execute arbitrary OS commands on the affected Totolink A8000RU router. This could lead to complete device compromise, including modification of router settings, installation of malicious firmware, interception of network traffic, and potential use of the router as part of a botnet. Given the availability of public exploits, a large number of devices are at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor web server logs for requests to \u003ccode\u003e/cgi-bin/cstecgi.cgi\u003c/code\u003e containing suspicious characters or command injection attempts in the \u003ccode\u003esys_info\u003c/code\u003e parameter to trigger the rule \u003ccode\u003eDetect Totolink A8000RU Command Injection Attempt\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eBlock or quarantine network traffic to and from devices attempting to access \u003ccode\u003e/cgi-bin/cstecgi.cgi\u003c/code\u003e with potentially malicious payloads.\u003c/li\u003e\n\u003cli\u003eConsider deploying a web application firewall (WAF) rule to block requests matching the attack patterns identified in CVE-2026-7153.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-27T20:32:04Z","date_published":"2026-04-27T20:32:04Z","id":"https://feed.craftedsignal.io/briefs/2026-04-29-totolink-command-injection/","summary":"A critical OS command injection vulnerability (CVE-2026-7153) exists in the Totolink A8000RU router, specifically in the `setMiniuiHomeInfoShow` function, allowing remote attackers to execute arbitrary commands by manipulating the `sys_info` argument.","title":"Totolink A8000RU OS Command Injection Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-04-29-totolink-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-7153","version":"https://jsonfeed.org/version/1.1"}