Totolink A8000RU CVE-2026-9477

Exploitation requires network reachability to the Totolink A8000RU Web Management Interface (the /cgi-bin/cstecgi.cgi endpoint) on firmware 7.1cu.643_b20200521, and the ability to send a POST request invoking the setAccessDeviceCfg handler with a malicious 'mac' argument; per CVSS 4.0 PR:N and UI:N, no authentication and no user interaction are required. The primary limiting factor is exposure scope - devices whose web admin is bound only to the LAN interface (the typical default) are not reachable from the internet, so real-world risk concentrates on units where WAN-side management has been deliberately enabled, where the device sits directly on a public IP, or where an internal attacker already has LAN access. Other firmware revisions of the A8000RU are not confirmed vulnerable from the provided data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) signals high real-world risk: network-reachable, low complexity, no authentication, no user interaction, with total compromise of confidentiality, integrity, and availability on the device itself (scope-changed metrics are not asserted). SSVC reinforces this with Automatable:yes and Technical Impact:total, and publicly available exploit code exists. However, EPSS at 0.89% (76th percentile) is moderate rather than alarming, suggesting widespread mass-exploitation has not (yet) been observed - consistent with a niche consumer/SMB router rather than enterprise-ubiquitous software. No CISA KEV listing has been published. Real priority is HIGH for anyone operating exposed A8000RU devices, but population-scale exploitation pressure appears lower than the raw CVSS suggests; treat as 'patch immediately if exposed, monitor otherwise.'

An attacker scans the internet for A8000RU devices exposing the management interface, then sends a single crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setAccessDeviceCfg with a 'mac' parameter containing shell metacharacters (e.g. backticks or ;) to chain arbitrary commands. Because publicly available exploit code exists and the operation is automatable per SSVC, the attacker can drop a reverse shell, install router-resident malware (e.g. Mirai-family botnet payloads typical for such CPE devices), or pivot into the LAN - all without credentials and in a single request.