TOTOLINK A8000RU EUVD-2026-25918

Exploitation requires network reachability to the router's CGI endpoint /cgi-bin/cstecgi.cgi and the ability to send a request invoking the setAdvancedInfoShow function with a malicious tty_server argument. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special attack requirements are needed - remote unauthenticated exploitation is possible against the affected TOTOLINK A8000RU (firmware 7.1cu.643_b20200521). The principal limiting factor is exposure: the attacker must be able to reach the device's management/CGI interface, so devices without WAN-side management or shielded behind firewalls/segmentation are not remotely exploitable from the internet, reducing realistic exposure to LAN-adjacent attackers or misconfigured/internet-facing units.

Signals are largely consistent toward elevated risk: the CVSS 4.0 vector describes a network-reachable, low-complexity, unauthenticated attack with total (VC:H/VI:H/VA:H) impact, and SSVC scores it Exploitation=poc, Automatable=yes, Technical Impact=total - a combination that supports prioritized patching. Publicly available exploit code lowers the barrier to weaponization. The countervailing signal is EPSS at only 0.89% (76th percentile), which suggests exploitation is not yet widespread, and the vulnerability is NOT listed in CISA KEV, so there is no confirmed active exploitation. This is a genuinely high-risk issue for exposed devices, but the low EPSS and absence of KEV listing indicate opportunistic/targeted rather than mass exploitation at this time; the primary risk driver is any A8000RU with its web/CGI interface reachable from untrusted networks.

An attacker who can reach the router's web management interface sends a crafted HTTP request to /cgi-bin/cstecgi.cgi invoking setAdvancedInfoShow with shell metacharacters embedded in the tty_server argument, causing the injected commands to execute on the device (typically as root). Because public exploit code exists (referenced on GitHub) and no authentication is required per the CVSS vector, an attacker could script this to seize control, pivot into the internal network, or enroll the device into a botnet. Low attack complexity means a single unauthenticated request is sufficient.