Totolink A8000RU CVE-2026-9433

Exploitation requires network reachability to the router's Web Management Interface on /cgi-bin/cstecgi.cgi and a Totolink A8000RU running firmware 7.1cu.643_b20200521; no authentication, user interaction, or non-default configuration is required per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N). The principal limiting factor in practice is exposure: by default the management interface is bound to the LAN, so internet-based exploitation requires the operator to have enabled remote/WAN management, while any attacker already on the same LAN segment (including via a compromised IoT device or guest Wi-Fi) can exploit it directly.

CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H scores 8.9 (High) and indicates remote, unauthenticated, low-complexity exploitation yielding full confidentiality, integrity, and availability impact on the device. SSVC reinforces this with Automatable=yes and Technical Impact=total, and publicly available exploit code exists. However, EPSS sits at only 0.89% (76th percentile), the CVE is not on CISA KEV, and exposure is bounded by whether the web management interface is reachable from the WAN - most consumer deployments expose it only on the LAN, which materially reduces real-world risk despite the high CVSS. Net assessment: priority for any organization with Totolink A8000RU devices having WAN-side management or untrusted LAN segments, lower urgency for residential deployments with LAN-only management.

An attacker who can reach the router's web management interface - for example, a malicious device on the LAN or any internet host if WAN-side management is enabled - sends a crafted HTTP request to /cgi-bin/cstecgi.cgi invoking setMacFilterRules with a shell metacharacter payload in the 'enable' argument. The injected command executes in the router's OS context (typically root on embedded Linux), giving the attacker persistent control over traffic, DNS, and downstream hosts. A public PoC is available at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_354/README.md, lowering the skill barrier substantially.