TOTOLINK A8000RU CVE-2026-9456

The attacker must be able to reach the TOTOLINK A8000RU Web Management Interface at the /cgi-bin/cstecgi.cgi endpoint over the network - no authentication, user interaction, or special privileges are required (CVSS PR:N/UI:N/AT:N). The specific limiting factor is network reachability of the admin interface: most A8000RU deployments do not expose the Web Management Interface to the WAN by default, so realistic exploitation requires either an administrator who has enabled remote management, an attacker positioned on the LAN (e.g., via Wi-Fi compromise or a foothold device), or a misconfigured device. The exploit targets firmware version 7.1cu.643_b20200521 specifically.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) indicates network-reachable, low-complexity, unauthenticated exploitation with high impact to confidentiality, integrity, and availability - yielding a score of 8.9. SSVC reinforces this: exploitation is at 'poc' stage, the attack is 'automatable', and technical impact is 'total'. However, EPSS sits at only 0.89% (76th percentile), and the CVE is not on the CISA KEV list, suggesting that while exploit code is public, mass exploitation has not materialized - likely because A8000RU devices are typically deployed behind NAT and the Web Management Interface is not exposed by default to the WAN. Real-world risk is high for any device that exposes the admin interface to untrusted networks (WAN-facing or open LAN), but moderate for typical home deployments. No conflicts in the data, but note that 'network' attack vector in CVSS does not distinguish LAN vs WAN reachability - defenders should verify their exposure surface.

An attacker who can reach the router's Web Management Interface (either via a misconfigured WAN-exposed admin port or from a compromised host on the LAN) sends an HTTP POST to /cgi-bin/cstecgi.cgi targeting the setOpenVpnCfg handler with a malicious 'enabled' parameter containing shell metacharacters. Because public PoC code exists and the SSVC framework labels the attack as automatable, exploitation can be scripted at scale against shodan-discoverable devices, granting the attacker root-level command execution on the router for persistent network pivoting, DNS hijacking, or botnet enrollment.