Totolink A8000RU EUVD-2026-31712

Exploitation requires network reachability to the Totolink A8000RU's Web Management Interface at /cgi-bin/cstecgi.cgi on firmware build 7.1cu.643_b20200521; per the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) no authentication, user interaction, or special configuration is required, and attack complexity is low. The practical limiting factor is reachability of the admin interface - by default consumer routers bind the management UI to the LAN only, so remote internet-based exploitation depends on the user having enabled WAN-side remote administration; if that option is disabled, exploitation requires an attacker foothold on the LAN (e.g., via a malicious Wi-Fi client, compromised LAN host, or CSRF from a browser on the network).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H), scoring 8.9. EPSS at 0.89% (76th percentile) appears modest but is consistent with niche consumer/SMB router CVEs that don't see mass scanning yet still get targeted by botnet operators (e.g., Mirai variants). The vulnerability is NOT listed in CISA KEV, so there is no confirmed active exploitation, but publicly available exploit code combined with the CVSS Exploit Maturity flag E:P (proof-of-concept) materially raises near-term risk. A key caveat: if the router's web management interface is bound only to LAN by default (typical for consumer routers), the 'network' attack vector in practice depends on whether the admin UI is WAN-exposed - a real-world limiting factor not captured by CVSS alone.

An attacker who can reach the router's web management interface (either via a WAN-exposed admin panel or from within the LAN, e.g., from a compromised host or open guest network) sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setParentalRules with shell metacharacters embedded in the 'enable' parameter. The injected command executes with the privileges of the web server process (typically root on embedded routers), enabling the attacker to add a persistent backdoor account, exfiltrate Wi-Fi credentials, or enroll the device in a botnet. Publicly available POC code at the referenced GitHub repository (Litengzheng/vuldb_new2) lowers the skill barrier substantially.