TOTOLINK A8000RU CVE-2026-9388

Exploitation requires network reachability to the device's Web Management Interface (HTTP/HTTPS on the LAN by default, or WAN if remote administration is enabled) and the ability to send a request to /cgi-bin/cstecgi.cgi invoking the setScheduleCfg endpoint with an attacker-controlled 'mode' argument. Per the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N), no authentication, user interaction, or special prerequisite conditions are required, and attack complexity is low. The principal limiting factor is exposure scope: the bug is confirmed only on TOTOLINK A8000RU firmware 7.1cu.643_b20200521, and routers whose admin interface is restricted to the LAN are not reachable from the internet, narrowing the realistic attacker population to LAN-adjacent actors unless WAN administration has been deliberately enabled.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity, and availability impact reflects a textbook remote-unauthenticated RCE-class issue, and the E:P (Proof-of-Concept) threat metric aligns with the public PoC on GitHub. However, the EPSS score of 0.89% (76th percentile) and absence from CISA KEV indicate that, despite easy exploitability, mass automated exploitation has not yet been observed - likely because the A8000RU has a smaller install base than mainstream brands and the device is not listed as actively exploited. Real-world risk is high for any A8000RU whose web admin is reachable from the internet or an untrusted LAN, but moderate in aggregate due to limited deployment footprint. No conflicting signals were found; the main uncertainty is whether other firmware builds beyond 7.1cu.643_b20200521 are also affected, as only this exact version is listed in EUVD/CPE data.

An attacker on the same network as the router - or on the internet if WAN administration is enabled - sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setScheduleCfg with a 'mode' value containing shell metacharacters (e.g., a semicolon followed by a wget|sh chain). Because the CGI runs as root and input is concatenated into a shell command, the injected payload executes with full privileges, allowing the attacker to pull down a botnet implant, alter DNS settings, or pivot into the LAN. A working PoC has already been published at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_335/README.md, lowering the skill barrier substantially.