EUVD-2026-31597
GHSA-j8qr-3593-h6q8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument command causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
Remote OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows unauthenticated attackers to execute arbitrary operating system commands by manipulating the 'command' argument in the setTracerouteCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and the CVSS 4.0 vector confirms network-reachable, low-complexity exploitation without authentication or user interaction, though EPSS remains modest at 0.89% (76th percentile) and the issue is not listed in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the router's Web Management Interface on the HTTP(S) admin port and the ability to issue a POST to /cgi-bin/cstecgi.cgi invoking the setTracerouteCfg endpoint with a crafted 'command' argument. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) scores 8.9 and indicates a remote, low-complexity, unauthenticated path to full confidentiality, integrity, and availability impact - among the worst possible exploitation profiles. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on the same network (or the Internet, if remote management is enabled) sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking the setTracerouteCfg action with a shell metacharacter payload in the 'command' field, causing the router to execute attacker-supplied commands as the web server's user (typically root on this class of device). Because publicly available exploit code exists in the referenced GitHub repository, weaponization requires minimal effort and yields a foothold suitable for installing botnet implants or pivoting into the internal network. |
| Remediation | No vendor-released patch identified at time of analysis - TOTOLINK has not published an advisory or fixed firmware in the supplied references (https://vuldb.com/vuln/365348, https://www.totolink.net/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Totolik A8000RU devices in production inventory, segment them from untrusted networks, and restrict WAN-facing access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today