TOTOLINK A8000RU CVE-2026-9455

Exploitation requires network reachability to the TOTOLINK A8000RU web management interface (typically TCP/80 or TCP/443 on the LAN, and on the WAN only if the owner has enabled remote management - which is not the default on most SOHO routers). The target must be running firmware version 7.1cu.643_b20200521; no authentication, user interaction, or special privileges are needed (PR:N/UI:N). The attack specifically targets the UploadOpenVpnCert handler, so the OpenVPN feature must be compiled into the firmware (it is in stock A8000RU images). Limiting factor: in default home deployments, WAN-side admin is off, so most real-world exploitation will originate from the LAN segment (e.g., compromised IoT device, malicious guest, or chained from a browser-based CSRF).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) with base score 8.9 indicates remote, low-complexity, unauthenticated exploitation yielding full confidentiality, integrity, and availability impact on the device - consistent with root-level RCE on the router. SSVC reinforces this with Automatable:yes and Technical Impact:total, and a public POC is referenced. However, EPSS at 0.89% (76th percentile) is comparatively modest and the CVE is not on CISA KEV, suggesting opportunistic rather than mass exploitation so far. Notable caveat: CVSS assumes the web management interface is reachable from the attacker's position, but in most home deployments the WAN-side management is disabled by default - real-world exposure depends heavily on whether owners enabled remote administration or whether the attacker is already on the LAN, which is not clarified in the source data.

An attacker reachable to the router's web management interface - either from the internet if remote administration is enabled, or from the local network - sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking UploadOpenVpnCert with a FileName parameter containing shell metacharacters (e.g., a semicolon or backtick followed by a payload). The injected command executes as the web server process, which on TOTOLINK devices typically runs as root, granting full device takeover. A public POC is referenced in the VulDB-linked GitHub repository (Litengzheng/vuldb_new2), making weaponization straightforward.