{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-7155/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-7155"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["A8000RU 7.1cu.643_b20200521"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-7155","command-injection","totolink"],"_cs_type":"advisory","_cs_vendors":["Totolink"],"content_html":"\u003cp\u003eA critical vulnerability, identified as CVE-2026-7155, affects the Totolink A8000RU router, specifically version 7.1cu.643_b20200521. This vulnerability resides within the CGI Handler component, in the \u003ccode\u003esetLoginPasswordCfg\u003c/code\u003e function of the \u003ccode\u003e/cgi-bin/cstecgi.cgi\u003c/code\u003e file. By manipulating the \u003ccode\u003eadmpass\u003c/code\u003e argument, a remote attacker can inject arbitrary operating system commands. The vulnerability is remotely exploitable without authentication. Given the availability of a public exploit, this poses a significant risk to unpatched devices, potentially leading to full system compromise. Defenders should prioritize patching or mitigating this vulnerability to prevent unauthorized access and control of affected devices.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a vulnerable Totolink A8000RU router running firmware version 7.1cu.643_b20200521.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a crafted HTTP POST request to \u003ccode\u003e/cgi-bin/cstecgi.cgi\u003c/code\u003e, targeting the \u003ccode\u003esetLoginPasswordCfg\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe POST request includes the \u003ccode\u003eadmpass\u003c/code\u003e argument containing a malicious payload designed for OS command injection.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esetLoginPasswordCfg\u003c/code\u003e function processes the \u003ccode\u003eadmpass\u003c/code\u003e argument without proper sanitization.\u003c/li\u003e\n\u003cli\u003eThe injected OS command is executed by the underlying operating system with the privileges of the web server.\u003c/li\u003e\n\u003cli\u003eThe attacker gains arbitrary code execution on the router.\u003c/li\u003e\n\u003cli\u003eThe attacker pivots to other internal systems.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-7155 allows a remote attacker to execute arbitrary commands on the affected Totolink A8000RU device. This can lead to complete compromise of the router, including modification of settings, interception of network traffic, or the use of the router as a botnet node. Given the prevalence of these devices in home and small business networks, a large number of devices are potentially vulnerable. The high CVSS score of 9.8 reflects the severity and ease of exploitation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Totolink A8000RU Command Injection Attempt\u003c/code\u003e to detect exploitation attempts against this vulnerability by monitoring web server logs.\u003c/li\u003e\n\u003cli\u003eApply available patches or firmware updates provided by Totolink for A8000RU 7.1cu.643_b20200521 to remediate CVE-2026-7155, if available.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for suspicious outbound connections originating from Totolink A8000RU devices, potentially indicating successful exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-27T21:16:43Z","date_published":"2026-04-27T21:16:43Z","id":"https://feed.craftedsignal.io/briefs/2026-04-27-totolink-command-injection/","summary":"CVE-2026-7155 is a critical OS command injection vulnerability in the Totolink A8000RU router that allows remote attackers to execute arbitrary commands by manipulating the 'admpass' argument in the setLoginPasswordCfg function.","title":"Totolink A8000RU OS Command Injection Vulnerability (CVE-2026-7155)","url":"https://feed.craftedsignal.io/briefs/2026-04-27-totolink-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-7155","version":"https://jsonfeed.org/version/1.1"}