Totolink A8000RU CVE-2026-9476

Reachability of the device's Web Management Interface (/cgi-bin/cstecgi.cgi) over HTTP is the sole prerequisite - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no user interaction, and no special attack requirements. Exploitation is limited in practice by whether the management interface is exposed to the WAN (most home deployments expose it only to the LAN by default), and the vulnerability is confirmed only against firmware 7.1cu.643_b20200521 of the A8000RU model - other firmware or models are not in scope of the provided data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 8.9 and reflects an unauthenticated, low-complexity network attack producing high impact on confidentiality, integrity, and availability of the device - typically equivalent to root-level shell on the router. EPSS sits at 0.89% (76th percentile), which is modest and indicates limited observed mass-scanning activity despite a publicly available PoC; this is consistent with the vulnerability being constrained to a niche SOHO device rather than a widely deployed enterprise platform. The vulnerability is not in CISA KEV, so there is no confirmation of active exploitation, but the combination of a public exploit, no authentication requirement, and full device compromise potential makes any internet-exposed A8000RU an immediate priority. EPSS percentile and KEV absence should be read as 'targeted/opportunistic risk' rather than 'low real-world risk' given the trivial exploit path.

An attacker scanning the internet for Totolink A8000RU devices with exposed web management sends a single crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setPasswordCfg with shell metacharacters embedded in the admpass argument, causing the injected commands to execute on the router. Because publicly available exploit code exists (https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_348/README.md), the attacker can drop a reverse shell, modify DNS, or enroll the router into a botnet without any prior credentials or user interaction.