Which versions of Totolink A8000RU are affected by EUVD-2026-31712?

The Totolik A8000RU router firmware 7.1cu.643_b20200521 contains a critical vulnerability allowing unauthenticated remote attackers to execute arbitrary operating system commands.

Is there a public PoC exploit available for EUVD-2026-31712?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31712. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate EUVD-2026-31712?

Within 24 hours: Identify and isolate all Totolik A8000RU devices; remove non-critical units from production immediately. Within 7 days: For devices that must remain operational, disable external management interfaces and restrict administrative access to internal networks only via firewall rules; implement network segmentation to contain potential compromise. Within 30 days: Replace all affected routers with devices from vendors maintaining active security support; establish hardware refresh schedules to prevent recurrence.

Totolink A8000RU EUVD-2026-31712

Q: What is the CVSS score of EUVD-2026-31712?

EUVD-2026-31712 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

| CVE-2026-9478 HIGH

OS Command Injection (CWE-78)

2026-05-25 VulDB

GHSA-prcq-7777-rj56

Command Injection A8000Ru

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:20 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 20:07 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands via the 'enable' parameter of the setParentalRules function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and while the EPSS score of 0.89% (76th percentile) suggests moderate predicted exploitation likelihood, the network-accessible attack surface on an edge device elevates real-world risk significantly.

Technical ContextAI

The vulnerability resides in the Totolink A8000RU's Web Management Interface, specifically within the cstecgi.cgi binary that handles administrative CGI requests. The setParentalRules function fails to properly sanitize the 'enable' argument before passing it to an operating system shell, which is the root cause class identified by CWE-78 (Improper Neutralization of Special Elements used in an OS Command). This pattern is common in SOHO router firmware where CGI handlers concatenate user-controlled HTTP parameters directly into system() or popen() calls without input validation. The affected product per CPE is cpe:2.3:a:totolink:a8000ru covering all versions, though EUVD pins exploitation specifically to firmware build 7.1cu.643_b20200521.

RemediationAI

No vendor-released patch identified at time of analysis - Totolink has not published a firmware update or security advisory referenced in the available intelligence. As compensating controls, administrators should immediately ensure the Web Management Interface is not exposed to the WAN side (disable remote administration in router settings), which is the most effective mitigation since exploitation requires reaching /cgi-bin/cstecgi.cgi; the trade-off is loss of remote management convenience. Additionally, restrict LAN-side access to the management interface to a dedicated admin VLAN or specific MAC addresses where supported, and monitor outbound traffic from the router for unexpected connections that may indicate post-exploitation activity. If the device is end-of-life or no firmware fix becomes available, consider replacing it with a supported model, since CWE-78 in CGI handlers typically indicates broader systemic input-handling weaknesses across the firmware. Track the VulDB advisory at https://vuldb.com/vuln/365459 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-9478 for any forthcoming vendor response.