TOTOLINK A8000RU CVE-2026-7138

Exploitation requires network reachability to the router's CGI endpoint /cgi-bin/cstecgi.cgi and the ability to invoke the setNtpCfg function with a malicious 'tz' (time zone) argument; per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no special attack requirements, and no user interaction are needed against the affected firmware. The concrete prerequisite is simply that the management HTTP interface exposing cstecgi.cgi is reachable from the attacker's position. The practical LIMIT on exploitation is exposure of that interface: many deployments do not expose the web admin to the WAN by default, so real-world attack surface is largely confined to devices with remote/WAN administration enabled or attackers already on the LAN, and exploitation is constrained to the specific model A8000RU on firmware 7.1cu.643_b20200521.

Signals are largely consistent toward real, but not yet widespread, risk. The CVSS 4.0 vector rates it 8.9 (High) with network vector, low complexity, no privileges and no user interaction, and total confidentiality/integrity/availability impact - a straightforward unauthenticated RCE profile. SSVC reinforces this: exploitation is 'poc', automatable 'yes', and technical impact 'total', which argues for prompt action. However, EPSS is only 0.89% (76th percentile) and there is NO CISA KEV entry, indicating that although a working public POC exists, broad opportunistic exploitation has not yet been observed. The main caveat is source diversity: all intelligence traces back to a single VulDB submission and its linked GitHub POC, so affected-version breadth and vendor confirmation are limited. Net: treat as a genuine high-priority issue for anyone running this specific device, but the low EPSS and absence of KEV suggest current exploitation is opportunistic/targeted rather than mass-scale.

An attacker who can reach the router's web interface sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setNtpCfg with a 'tz' value containing shell metacharacters (e.g. a semicolon or backtick followed by commands). The injected commands run with web-server privileges (typically root), giving full device takeover - persistence, traffic interception, or pivoting into the internal network. A public POC exists (linked GitHub README), and the low attack complexity means the exploit can be scripted and automated.