TOTOLINK A8000RU CVE-2026-7139

Exploitation requires network reachability to the router's HTTP management service and specifically the /cgi-bin/cstecgi.cgi endpoint invoking the setWiFiAclRules function; the attacker manipulates the 'mode' argument to inject OS commands. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no user interaction, and no special attack requirements are needed against the affected firmware 7.1cu.643_b20200521. The practical limiting factor is exposure of the management interface: on default home deployments the web admin is typically LAN-only, so Internet-wide exploitation depends on WAN-side administration being enabled or the interface otherwise being remotely reachable. Only the A8000RU model at the stated firmware is confirmed affected.

The signals are largely consistent and point to a genuinely high-impact but narrow-footprint issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) indicates remote, low-complexity, unauthenticated exploitation with total confidentiality, integrity, and availability loss on the device, corroborated by SSVC (Automatable: yes, Technical Impact: total). Publicly available exploit code lowers the barrier further. The main tempering signal is exploitation maturity and reach: EPSS is only 0.89% (76th percentile) and there is no CISA KEV listing, so exploitation is proof-of-concept (E:P) rather than confirmed active. The low EPSS despite a working POC most plausibly reflects the limited real-world deployment of this specific consumer router model rather than any difficulty of exploitation. Note the exposure caveat: 'remote' here means network-reachable to the management interface - for most home deployments that is the LAN side unless WAN-side admin is exposed, which materially limits internet-wide risk. Overall: a real priority for anyone operating this device, but not a mass-Internet emergency absent evidence of WAN exposure or active exploitation.

An attacker who can reach the router's web interface - e.g., a malicious device on the LAN, or anyone on the Internet if WAN-side administration is enabled - sends a single crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setWiFiAclRules with shell metacharacters in the 'mode' argument. Because no authentication is required and complexity is low, the injected command executes (typically as root), giving full device takeover. Published exploit code exists (VulDB / GitHub write-up), making this trivially reproducible.