Which versions of TOTOLINK A8000RU are affected by EUVD-2026-25920?

The TOTOLINK A8000RU router contains a critical command injection vulnerability affecting firmware 7.1cu.643_b20200521; publicly available exploit code exists, though confirmed active exploitation…

Is there a public PoC exploit available for EUVD-2026-25920?

Yes, a public proof-of-concept exploit is available for EUVD-2026-25920. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate EUVD-2026-25920?

Within 24 hours, identify and inventory all TOTOLINK A8000RU routers in your environment, particularly those running firmware version 7.1cu.643_b20200521, and isolate them from untrusted network segments; document their locations and functions. Within 7 days, implement network segmentation and firewall rules to restrict all administrative access to these devices to a secured management network only, and disable remote management interfaces if not operationally critical. Within 30 days, develop a replacement strategy for any A8000RU routers that cannot be adequately isolated, prioritizing migration to router hardware from vendors with demonstrated security update practices and vulnerability response capabilities.

TOTOLINK A8000RU EUVD-2026-25920

Q: What is the CVSS score of EUVD-2026-25920?

EUVD-2026-25920 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

| CVE-2026-7155 HIGH

OS Command Injection (CWE-78)

2026-04-27 VulDB

Command Injection TOTOLINK A8000Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote unauthenticated call to the CGI handler (AV:N/AC:L/PR:N/UI:N) yields root command execution, so C/I/A:H; scope unchanged as impact stays within the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:59 vuln.today

PoC Detected

Apr 28, 2026 - 20:24 vuln.today

Public exploit code

Severity Changed

Apr 27, 2026 - 21:22 NVD

CRITICAL HIGH

CVSS changed

Apr 27, 2026 - 21:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 20:30 euvd

EUVD-2026-25920

CVE Published

Apr 27, 2026 - 20:15 nvd

HIGH 8.9

DescriptionCVE.org

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote attackers execute arbitrary shell commands by injecting into the admpass argument of the setLoginPasswordCfg function in /cgi-bin/cstecgi.cgi. The CGI Handler passes attacker-controlled input to a system shell without sanitization, granting full device compromise. Publicly available exploit code exists (disclosed via VulDB/GitHub); no active exploitation is confirmed in CISA KEV, and EPSS is modest at 0.89% (76th percentile).

Technical ContextAI

The vulnerability lies in cstecgi.cgi, the monolithic CGI dispatcher used across TOTOLINK's SOHO router firmware to handle web administration requests. The setLoginPasswordCfg handler processes the admpass parameter - intended to set the device login password - and passes it into an OS command context (e.g., via system()/popen or a shell helper) without escaping shell metacharacters. This is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw, where user input crosses into the command interpreter. TOTOLINK's cstecgi.cgi has a long history of similar injection points, and these embedded MIPS/ARM Linux routers typically run the web server and CGI as root, so injected commands execute with maximal privilege.

RemediationAI

No vendor-released patch identified at time of analysis - TOTOLINK has not published a fixed firmware version in the available data, and the A8000RU is an older/likely end-of-support model. As compensating controls: disable remote (WAN-side) web administration so /cgi-bin/cstecgi.cgi is unreachable from the internet (primary risk reducer, no functional loss for typical users); restrict LAN access to the admin interface via firewall/ACL to trusted management hosts only (limits lateral abuse but may complicate legitimate admin); place the device behind a separate firewall and block inbound access to the HTTP admin port; and if feasible, replace the device with a supported model, since embedded routers running CGI as root offer little in-place mitigation. Monitor VulDB (https://vuldb.com/vuln/359754) and https://www.totolink.net/ for a patched firmware release. Trade-off: disabling remote management prevents off-site administration but is the single most effective mitigation given the unauthenticated remote command execution.