Totolink A8000RU EUVD-2026-31606

Exploitation requires network reachability to the Totolink A8000RU web management interface (typically TCP/80 or TCP/443) and that the device is running firmware 7.1cu.643_b20200521. No authentication, user interaction, or special configuration is needed (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N), so default deployments are vulnerable out of the box. The principal limiting factor is whether the web admin interface is exposed to the WAN - devices with remote management disabled (the typical factory default on many SOHO routers) are only exploitable from the LAN side, which significantly reduces the attacker population to local network users, malicious Wi-Fi clients, or attackers who have already established a foothold inside the network.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity, and availability impact on the vulnerable system (VC:H/VI:H/VA:H) describes the worst-case profile: remote, network-reachable, no authentication, no user interaction, low complexity. The E:P (Proof-of-Concept) attack maturity is corroborated by a working PoC published on GitHub (Litengzheng/vuldb_new2). EPSS of 0.89% (76th percentile) is moderate - higher than most CVEs but not in the top tier of mass-exploited issues, which is consistent with embedded SOHO routers being targeted opportunistically rather than at scale by sophisticated actors. The CVE is NOT listed in CISA KEV, so there is no confirmation of active in-the-wild exploitation; however, Totolink devices have a long history of being absorbed into IoT botnets (Mirai variants), and any internet-exposed A8000RU should be treated as high priority. Risk is sharply lower for devices whose web admin interface is restricted to LAN-only access.

An attacker scans the internet for Totolink A8000RU devices exposing the web management interface, then sends a single crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setRemoteCfg with shell metacharacters embedded in the 'enable' argument, achieving command execution as the web server process (typically root on embedded Linux routers). With a public PoC already available on GitHub, this is trivially reproducible and lends itself to botnet recruitment, DNS hijacking, or pivoting onto the internal LAN.