TOTOLINK A8000RU CVE-2026-9408

Exploitation requires network reachability to the A8000RU web management interface on firmware 7.1cu.643_b20200521 and the ability to send a request to /cgi-bin/cstecgi.cgi invoking the setStaticDhcpRules function with a malicious 'enable' argument. No authentication, no user interaction, and no non-default configuration are required per the CVSS 4.0 vector (PR:N/UI:N/AT:N), so any default-deployed A8000RU exposing its web UI is exploitable. The practical limiter is exposure: devices whose management interface is bound only to the LAN are not directly reachable from the internet, so WAN-side exposure (or attacker presence on the LAN) is the gating factor rather than any software precondition.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 8.9) indicates a network-reachable, low-complexity, unauthenticated path to full confidentiality, integrity, and availability impact on the vulnerable component, and SSVC corroborates this with Exploitation=poc, Automatable=yes, Technical Impact=total. Publicly available exploit code exists (a GitHub PoC is linked in the references), yet the vulnerability is not listed in CISA KEV and EPSS is only 0.89% (76th percentile) - this gap is typical for SOHO router CVEs reported via VulDB: the technical severity is real, but mass exploitation telemetry lags because affected devices are dispersed across home networks rather than enterprise asset inventories. Real-world risk is high for any A8000RU whose management interface is reachable from the WAN or an untrusted segment, and lower (but still material) for LAN-only deployments where a compromised endpoint could pivot. No conflicting data was observed between CVSS, SSVC, and the description.

An attacker scans the internet (or an adjacent network) for A8000RU devices exposing /cgi-bin/cstecgi.cgi, then sends a single crafted POST to invoke setStaticDhcpRules with shell metacharacters embedded in the 'enable' argument, causing the CGI to execute attacker-chosen commands as root. The publicly available PoC at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_340/README.md lowers the skill bar significantly, and because SSVC flags the issue as automatable, the realistic next step is botnet-style mass enrollment (telnet/SSH backdoor, downloader payload, or DNS hijack) rather than targeted intrusion.