This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. It arises from improper input validation in the setWizardCfg function within the /cgi-bin/cstecgi.cgi CGI handler, allowing remote attackers to inject OS commands via the 'wizard' parameter. The vulnerability is remotely exploitable without authentication or user interaction, resulting in a critical security risk. The CVSS 4.0 base score is 9.3, reflecting high impact on confidentiality, integrity, and availability. No official patch or remediation level has been disclosed by the vendor, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data theft, disruption of network services, or use of the device as a pivot point for further attacks. The vulnerability requires no privileges or user interaction, increasing its severity. However, there are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the device's management interface from untrusted networks and disabling remote management features if possible to reduce exposure.