This vulnerability exists in the Totolink A8000RU router firmware 7.1cu.643_b20200521, specifically in the CGI handler component's setVpnPassCfg function. The issue arises from improper sanitization of the pptpPassThru parameter, allowing an attacker to inject OS commands remotely via the /cgi-bin/cstecgi.cgi endpoint. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS v4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor patch or official remediation has been documented.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full compromise of the router. This can impact device confidentiality, integrity, and availability. The vulnerability is rated critical with a CVSS score of 9.3. Although an exploit is publicly available, there are no confirmed incidents of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling vulnerable services or restricting access to the affected CGI endpoint if possible. Monitor vendor channels for updates and apply patches promptly once available.