Totolink A8000RU CVE-2026-9404

The attacker must be able to reach the router's Web Management Interface over HTTP/HTTPS - exploitation requires only network reachability to /cgi-bin/cstecgi.cgi on a Totolink A8000RU running firmware 7.1cu.643_b20200521; no credentials, no user interaction, and no non-default configuration are needed (CVSS AV:N/AC:L/PR:N/UI:N). The practical limiting factor is whether the admin interface is exposed: routers whose web UI is bound only to the LAN are exploitable solely from the local network or via a chained CSRF/foothold, while routers with WAN-side remote administration enabled are exploitable directly from the internet. The vulnerable code path is the setDdnsCfg handler, so the device must have the DDNS configuration feature compiled in (it is part of stock A8000RU firmware).

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N indicates the lowest possible barrier to exploitation - network-reachable, low complexity, no authentication, no user interaction - with high confidentiality, integrity, and availability impact on the vulnerable component (VC:H/VI:H/VA:H), justifying the 8.9 score. The E:P (Proof-of-concept) exploit maturity is corroborated by a publicly hosted PoC on GitHub. EPSS at 0.89% (76th percentile) is moderate rather than elevated, which is typical for SOHO router CVEs that lack mass-scanner targeting yet, and the vulnerability is not present in CISA KEV, so active exploitation is not confirmed. The realistic risk is high for any A8000RU whose web admin interface is exposed to the WAN or to an untrusted LAN segment; risk is meaningfully lower for devices whose admin UI is restricted to a trusted management VLAN. No SSVC decision data was supplied; the assessment above is inferred from CVSS, EPSS, KEV, and PoC signals.

An attacker on the same network segment, or on the internet if the router's web admin is WAN-exposed, sends a single crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setDdnsCfg with a 'provider' value containing shell metacharacters (for example, a command-substitution payload that runs telnetd or fetches a second-stage binary). Because the request needs no credentials and a working PoC is published on GitHub, the scenario reduces to scan-and-shell automation that drops the router into a botnet, alters DNS settings for traffic interception, or pivots into the LAN.