Which versions of TOTOLINK A8000RU are affected by EUVD-2026-25918?

TOTOLINK A8000RU routers (firmware 7.1cu.643_b20200521) are vulnerable to remote command execution by unauthenticated attackers without any network credentials or user interaction, creating a direct…

Is there a public PoC exploit available for EUVD-2026-25918?

Yes, a public proof-of-concept exploit is available for EUVD-2026-25918. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate EUVD-2026-25918?

Within 24 hours: inventory all TOTOLIK A8000RU devices running firmware 7.1cu.643_b20200521 and document their network placement and criticality; immediately disable remote management (WAN access) if operationally feasible. Within 7 days: contact TOTOLINK support for patch availability; test any available firmware upgrades in a non-production environment and document compatibility with your network environment. Within 30 days: deploy the latest available TOTOLINK firmware to all affected devices, or if no patch is available, implement network segmentation to restrict administrative access to these routers and consider device replacement based on vendor roadmap.

TOTOLINK A8000RU EUVD-2026-25918

Q: What is the CVSS score of EUVD-2026-25918?

EUVD-2026-25918 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

| CVE-2026-7154 HIGH

OS Command Injection (CWE-78)

2026-04-27 VulDB

Command Injection TOTOLINK A8000Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network request to the CGI endpoint (AV:N/AC:L/PR:N/UI:N) yields root command execution with full C/I/A impact; scope unchanged as commands run within the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:00 vuln.today

PoC Detected

Apr 28, 2026 - 20:24 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 21:22 NVD

CRITICAL HIGH

CVSS changed

Apr 27, 2026 - 21:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 20:30 euvd

EUVD-2026-25918

CVE Published

Apr 27, 2026 - 20:00 nvd

HIGH 8.9

DescriptionCVE.org

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument tty_server can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary system commands by manipulating the tty_server argument passed to the setAdvancedInfoShow function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists and the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation yielding full confidentiality, integrity, and availability impact. EPSS is currently low (0.89%, 76th percentile) and there is no public exploit identified as being actively used in the wild per CISA KEV.

Technical ContextAI

The affected component is the cstecgi.cgi CGI handler, a common attack surface across TOTOLINK SOHO routers that dispatches to internal functions such as setAdvancedInfoShow based on request parameters. The root cause maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning the tty_server parameter is passed into a shell/system() call without sanitization, allowing shell metacharacters to break out and execute attacker-controlled commands. Per the CPE (cpe:2.3:a:totolink:a8000ru:*:*:*:*:*:*:*:*) the flaw is confirmed in the A8000RU product line; these are Linux/BusyBox-based embedded devices where injected commands typically run as root, providing complete device control.

RemediationAI

No vendor-released patch identified at time of analysis - the references (VulDB https://vuldb.com/vuln/359753 and the exploit writeup at https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_318/README.md) do not cite a fixed firmware version. Until TOTOLINK issues fixed firmware, apply compensating controls: disable remote/WAN management so the /cgi-bin/cstecgi.cgi interface is not reachable from the internet (trade-off: loss of remote administration convenience); restrict access to the web management interface to trusted management VLANs or specific management hosts via firewall/ACL (trade-off: administrative overhead); place the device behind a segmented network and block inbound access to its HTTP management port from untrusted networks. Given the product's age and firmware date, consider replacing end-of-life A8000RU units with a currently supported router if no patch is forthcoming. Monitor https://www.totolink.net/ for updated firmware.