EUVD-2026-31709
GHSA-5hgh-g649-8hm2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument admpass leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used.
AnalysisAI
OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the admpass parameter sent to the setPasswordCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists and the flaw is reachable over the network without user interaction, though no public exploit identified at time of analysis indicates active in-the-wild abuse via CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Reachability of the device's Web Management Interface (/cgi-bin/cstecgi.cgi) over HTTP is the sole prerequisite - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no user interaction, and no special attack requirements. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 8.9 and reflects an unauthenticated, low-complexity network attack producing high impact on confidentiality, integrity, and availability of the device - typically equivalent to root-level shell on the router. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scanning the internet for Totolink A8000RU devices with exposed web management sends a single crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setPasswordCfg with shell metacharacters embedded in the admpass argument, causing the injected commands to execute on the router. Because publicly available exploit code exists (https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_348/README.md), the attacker can drop a reverse shell, modify DNS, or enroll the router into a botnet without any prior credentials or user interaction. |
| Remediation | No vendor-released patch identified at time of analysis - the provided references include VulDB entries and a PoC but no Totolink firmware advisory or fixed version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Conduct comprehensive inventory to identify all Totolik A8000RU devices in use; document firmware versions and network accessibility. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today