TOTOLINK A8000RU EUVD-2026-25920

Exploitation requires network reachability to the router's HTTP administration interface and the ability to invoke the setLoginPasswordCfg action of /cgi-bin/cstecgi.cgi with a malicious admpass value containing shell metacharacters. Per the CVSS 4.0 vector (PR:N/UI:N), no authentication or user interaction is claimed, so against a default configuration a remote unauthenticated attacker who can reach the web UI can trigger it. The principal LIMITING factor is exposure: the management interface must be reachable by the attacker - devices with WAN-side admin disabled (the common default) are only exploitable from the LAN, sharply reducing real-world reach. Only firmware 7.1cu.643_b20200521 is confirmed affected; other builds are unverified. Note the PR:N assumption should be validated, as some cstecgi.cgi endpoints enforce a session token.

Signals are moderately consistent and lean toward genuine but not top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H, score 8.9) indicates remote, unauthenticated, low-complexity exploitation with total impact, and SSVC corroborates this (Exploitation: poc, Automatable: yes, Technical Impact: total). However, EPSS is only 0.89% (76th percentile), which is low-to-moderate and reflects that broad opportunistic exploitation has not materialized - typical of niche consumer router CVEs that require internet-exposed management interfaces. The tension to note: CVSS/SSVC rate this near-critical and automatable, yet real-world risk depends heavily on whether the admin web interface is reachable (LAN-only vs WAN-exposed). PR:N assumes the setLoginPasswordCfg endpoint is callable without prior authentication; TOTOLINK devices are frequently exploited pre-auth, but this should be verified against the specific endpoint, as some cstecgi.cgi handlers require a session. Net: a real, POC-backed flaw with total device impact, but exposure-limited rather than mass-exploited.

An attacker who can reach the router's web management interface sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setLoginPasswordCfg with a shell metacharacter payload in the admpass field (e.g., admpass=x;telnetd -l/bin/sh -p9999). The injected command runs as root, giving the attacker a shell, persistence, and full control of the device and its traffic. Public POC/exploit code referenced on GitHub (Litengzheng/vuldb_new2) lowers the skill barrier, and CVSS AC:L means no special timing or race conditions are required.