Totolink A8000RU EUVD-2026-31610

The device must be a Totolink A8000RU running firmware 7.1cu.643_b20200521 with the Web Management Interface (cstecgi.cgi) reachable by the attacker; no authentication, user interaction, or non-default configuration is required per CVSS 4.0 PR:N/UI:N/AC:L. The primary limiting factor is network reachability of the management interface: by default many SOHO routers expose admin only to the LAN, so internet-wide exploitation depends on the operator having enabled WAN-side remote administration or the device being placed directly on a public IP. Exploitation is also constrained to this specific A8000RU firmware build as listed in the EUVD entry - other Totolink models or firmware versions are not confirmed vulnerable from the provided data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) confirms a network-reachable, low-complexity, unauthenticated attack yielding full confidentiality, integrity, and availability compromise, scoring 8.9. SSVC reinforces this with Exploitation=poc, Automatable=yes, and Technical Impact=total - a profile that typically warrants prioritized action. However, EPSS is only 0.89% and the CVE is not in CISA KEV, suggesting that while the vulnerability is technically severe and a public POC exists on GitHub, real-world exploitation volume remains limited, likely because the A8000RU is a niche consumer/SMB router with modest install base. The key conflict: high technical severity and automatable POC versus low EPSS and no KEV listing - this is a real priority for any organization actually deploying A8000RU devices, especially those with the Web Management Interface exposed to WAN, but lower priority for fleets without this hardware.

An attacker scans the internet for Totolink A8000RU devices exposing /cgi-bin/cstecgi.cgi on the WAN interface, then sends a single crafted HTTP request to the setFirewallType endpoint with shell metacharacters injected into the firewallType parameter, achieving command execution as the web server user (typically root on embedded routers). Because a public POC is available on GitHub (Litengzheng/vuldb_new2) and SSVC marks the attack as automatable, mass scanning and botnet recruitment (e.g., Mirai-style) are realistic outcomes for any exposed device.