Deviceways

Router

TOTOLINK A8000RU

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
Hardware revision not specified
Release listed · 25.12.6
Hardware revision not specified
Release listed · 25.12.5
Open hardware recordopenwrt.org
Original project github.com
Sources

Hardware details

Technical references

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 9.8 (v3.1)

TOTOLINK A8000RU

TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow.

CVE-2024-24324

Affected firmware
A8000RU: v7.1cu.643_B20200521 was discovered to
Fix
Fix details in the linked record
Read mitre CVE record
Details and sources
CVE updated

TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow.

CVE published

CVSS 9.3 (v4.0)

A8000RU

Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection

CVE-2026-9478

Affected firmware
7.1cu.643_b20200521
Fix
Fix details in the linked record
Read VulDB CVE record
Details and sources
CVE updated

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

VDB-365459 | Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection — A8000RU (vuldb.com) ↗VDB-365459 | CTI Indicators (IOB, IOC, TTP, IOA) — A8000RU (vuldb.com) ↗Submit #813463 | Totolink A8000RU 7.1cu.643_b20200521 Command Injection — A8000RU (vuldb.com) ↗
CVE published

CVSS 9.3 (v4.0)

A8000RU

Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection

CVE-2026-9477

Affected firmware
7.1cu.643_b20200521
Fix
Fix details in the linked record
Read VulDB CVE record
Details and sources
CVE updated

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

VDB-365458 | Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection — A8000RU (vuldb.com) ↗VDB-365458 | CTI Indicators (IOB, IOC, TTP, IOA) — A8000RU (vuldb.com) ↗Submit #813460 | Totolink A8000RU 7.1cu.643_b20200521 Command Injection — A8000RU (vuldb.com) ↗
CVE published

CVSS 9.3 (v4.0)

A8000RU

Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection

CVE-2026-9476

Affected firmware
7.1cu.643_b20200521
Fix
Fix details in the linked record
Read VulDB CVE record
Details and sources
CVE updated

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument admpass leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used.

VDB-365457 | Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection — A8000RU (vuldb.com) ↗VDB-365457 | CTI Indicators (IOB, IOC, TTP, IOA) — A8000RU (vuldb.com) ↗Submit #813459 | Totolink A8000RU 7.1cu.643_b20200521 Command Injection — A8000RU (vuldb.com) ↗
CVE published

CVSS 9.3 (v4.0)

A8000RU

Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection

CVE-2026-9475

Affected firmware
7.1cu.643_b20200521
Fix
Fix details in the linked record
Read VulDB CVE record
Details and sources
CVE updated

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument Comment causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

VDB-365456 | Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection — A8000RU (vuldb.com) ↗VDB-365456 | CTI Indicators (IOB, IOC, TTP, IOA) — A8000RU (vuldb.com) ↗Submit #813458 | Totolink A8000RU 7.1cu.643_b20200521 Command Injection — A8000RU (vuldb.com) ↗
Check more security advisories for this device · CVE.org