EUVD-2026-31710
GHSA-v665-872m-c6wh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the 'mac' parameter sent to the setAccessDeviceCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and SSVC rates the technical impact as total with automatable exploitation, though EPSS remains modest at 0.89% (76th percentile). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Totolink A8000RU Web Management Interface (the /cgi-bin/cstecgi.cgi endpoint) on firmware 7.1cu.643_b20200521, and the ability to send a POST request invoking the setAccessDeviceCfg handler with a malicious 'mac' argument; per CVSS 4.0 PR:N and UI:N, no authentication and no user interaction are required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) signals high real-world risk: network-reachable, low complexity, no authentication, no user interaction, with total compromise of confidentiality, integrity, and availability on the device itself (scope-changed metrics are not asserted). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans the internet for A8000RU devices exposing the management interface, then sends a single crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setAccessDeviceCfg with a 'mac' parameter containing shell metacharacters (e.g. backticks or ;) to chain arbitrary commands. … |
| Remediation | No vendor-released patch identified at time of analysis - Totolink has not published a specific fixed firmware version in the available data, so administrators should monitor https://www.totolink.net/ for an updated build superseding 7.1cu.643_b20200521 and apply it as soon as available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Conduct an inventory of all Totolik A8000RU devices and confirm firmware versions; restrict external access to potentially affected units. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today