Totolink A8000RU EUVD-2026-31637

No special conditions - remote unauthenticated exploitation against default configurations of the Totolink A8000RU running firmware 7.1cu.643_b20200521, as long as the web management interface (/cgi-bin/cstecgi.cgi) is reachable from the attacker's network position. Limiting factors: the attacker must have network reachability to the device's HTTP management port (mitigated when WAN-side admin is disabled, which is the default on many ISP deployments), and exploitation is constrained to this specific firmware build per the EUVD-listed affected version - other A8000RU firmware revisions are not confirmed vulnerable from the supplied data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) indicates the flaw is network-reachable, low-complexity, unauthenticated, requires no user interaction, and yields full confidentiality/integrity/availability impact - confirmed by the SSVC assessment of Automatable=yes and Technical Impact=total. Publicly available exploit code further lowers the bar, but the EPSS score of 0.89% (76th percentile) and absence from CISA KEV suggest exploitation is opportunistic rather than widespread at scale. Realistic risk is high for any A8000RU device with the web management interface exposed to the internet or an untrusted LAN segment; for devices reachable only on a trusted management VLAN, exposure is lower but still meaningful given the trivial exploitation profile. No conflicting signals were identified across CVSS, SSVC, EPSS, and POC indicators.

An attacker locates an internet-exposed A8000RU (e.g., via Shodan or routine scanning of port 80/443), sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setWiFiAdvancedCfg with shell metacharacters injected into the bgProtection argument, and obtains command execution as the web server user - typically root on embedded routers. With the public POC referenced at github.com/Litengzheng/vuldb_new2, this can be automated to deploy router-resident malware (e.g., Mirai-class implants), pivot into the LAN, or modify DNS/routing to intercept user traffic.