TOTOLINK A8000RU EUVD-2026-25915

The concrete prerequisite is network reachability to the router's HTTP management service exposing /cgi-bin/cstecgi.cgi and the ability to invoke the setMiniuiHomeInfoShow handler with a controlled sys_info argument on firmware 7.1cu.643_b20200521. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required against a reachable device; however, this contradicts the typical TOTOLINK design where cstecgi.cgi actions require an authenticated session, so PR:N should be verified. Practical limiting factors: exploitation requires that the management interface be reachable from the attacker's network position (devices are frequently LAN-only rather than WAN-exposed), and it is confirmed only for the specific A8000RU firmware build named.

Signals are mostly aligned toward real, but not critical-priority, risk. The CVSS 4.0 base score is 8.9 (High) with AV:N/AC:L/AT:N/PR:N/UI:N and total confidentiality/integrity/availability impact on the vulnerable system (VC:H/VI:H/VA:H, SC:N/SI:N/SA:N), and SSVC classifies it as Automatable=yes with Technical Impact=total - a profile favorable to opportunistic scanning and worm-style abuse. Counterbalancing this, EPSS is only 0.89% (76th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation despite a public POC. The main uncertainty is authentication: many TOTOLINK cstecgi.cgi endpoints require a valid session in practice, but the provided CVSS vector states PR:N (unauthenticated); this should be verified against the actual firmware because it materially changes real-world exposure. Net: a genuine, easily-automated command-injection flaw on an internet-exposed device class, worth prompt remediation, but current telemetry indicates targeted/POC-stage rather than mass exploitation.

An attacker who can reach the router's web interface sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setMiniuiHomeInfoShow with shell metacharacters embedded in the sys_info parameter, causing the injected commands to run on the device (typically as root). A public POC exists (VulDB/GitHub), and because SSVC rates the attack Automatable, it could be scripted to sweep exposed devices for takeover, botnet enrollment, or traffic interception.