TOTOLINK A8000RU EUVD-2026-25914

The attacker must be able to reach the router's HTTP management interface hosting /cgi-bin/cstecgi.cgi and send a request invoking the setTelnetCfg function with a malicious telnet_enabled value containing shell metacharacters. The CVSS 4.0 vector states PR:N/UI:N/AC:L/AT:N, implying no authentication or user interaction is required against the affected firmware; however, TOTOLINK cstecgi.cgi handlers often enforce a login session, so unauthenticated reachability of this specific handler should be independently confirmed. The primary limiting factor is network exposure: SOHO router admin interfaces are usually bound to the LAN by default, so remote exploitation typically requires that WAN-side/remote web management be enabled or that the attacker already has LAN access. Only firmware 7.1cu.643_b20200521 on the A8000RU is confirmed affected.

The signals are moderately consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) describes a network-reachable, low-complexity, unauthenticated attack with total technical impact, which the SSVC framework corroborates (Exploitation: poc, Automatable: yes, Technical Impact: total). Publicly available exploit code exists, raising practical exploitability. However, EPSS is only 0.89% (76th percentile) and the CVE is not in CISA KEV, so there is no confirmed active exploitation - this reads as a real but not yet mass-exploited issue. A key caveat: the CVSS vector asserts PR:N (unauthenticated), but many TOTOLINK cstecgi.cgi handlers historically require or check a session/login, so whether setTelnetCfg is truly reachable pre-authentication should be verified against the device firmware. Overall this is a genuine high-priority issue for exposed devices given root-level command execution and available POC, tempered by typically limited internet exposure of a SOHO router's admin interface.

An attacker who can reach the router's web interface sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setTelnetCfg with shell metacharacters embedded in the telnet_enabled argument, causing the injected command to run as root on the device. Because publicly available exploit code exists and the attack complexity is low, this can be executed reliably and even scripted; a successful attacker gains full control of the router to pivot, intercept traffic, or enroll the device into a botnet.