TOTOLINK A8000RU EUVD-2026-25874

Exploitation requires reachability of the device's web management endpoint /cgi-bin/cstecgi.cgi and the ability to invoke the setDmzCfg handler with a malicious wanIdx parameter; no user interaction is needed and the supplied CVSS vector asserts PR:N (no authentication). Limiting factors: exploitation is only WAN-reachable if remote/HTTP administration is exposed to the internet - by default many TOTOLINK routers restrict the admin interface to the LAN, so an internet attacker may need the device to have remote management enabled, and if the firmware in fact gates setDmzCfg behind a login session then valid credentials or a session would be required despite the PR:N claim. It is specific to the A8000RU firmware 7.1cu.643_b20200521; other models/builds are not confirmed affected.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 8.9) describes an unauthenticated, low-complexity, network-reachable path to total compromise, and SSVC corroborates this (Exploitation: poc, Automatable: yes, Technical Impact: total), so the theoretical severity is high. Countervailing real-world signals temper the priority: EPSS is only 0.89% (76th percentile), there is no CISA KEV listing (no confirmed active exploitation), and the sole source is a VulDB community submission with a GitHub PoC. A notable caveat is that many TOTOLINK cstecgi.cgi setXxx handlers require an authenticated session on the LAN interface in practice, whereas the vector asserts PR:N - this authentication/exposure assumption should be verified against the actual firmware, since it materially changes whether this is remotely exploitable from the WAN or only post-authentication/LAN-side. Net: a credible, exploit-available issue on an end-of-interest consumer router, but the low EPSS and absence of KEV suggest opportunistic/targeted rather than widespread mass exploitation.

An attacker who can reach the router's web interface sends a crafted request to /cgi-bin/cstecgi.cgi invoking setDmzCfg with a wanIdx value containing shell metacharacters (e.g. ; telnetd -l /bin/sh), causing the injected command to run with the CGI process's privileges (typically root on these devices). Because public PoC code exists and the SSVC assessment marks the attack automatable, an attacker could script mass scanning to plant a reverse shell or enlist the device into a botnet. If the WAN interface exposes the admin panel, exploitation is possible directly from the internet without user interaction.