The Totolink A8000RU router firmware version 7.1cu.643_b20200521 contains an OS command injection vulnerability in the CGI handler component, specifically in the setIptvCfg function of /cgi-bin/cstecgi.cgi. Remote attackers can exploit this by manipulating the setIptvCfg argument to execute arbitrary operating system commands without authentication. This vulnerability is remotely exploitable with no user interaction required and has a CVSS 4.0 base score of 9.3, reflecting its critical impact. The vulnerability was publicly disclosed on 2026-04-27, and a public exploit exists. However, no official patch or mitigation has been announced by Totolink, and the device is not a cloud service, so remediation depends on vendor action or user intervention.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary OS commands on the affected device, potentially leading to full system compromise. This can result in unauthorized control over the router, disruption of network services, and further attacks on connected networks or devices. The vulnerability is critical due to its remote, unauthenticated nature and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published by Totolink, users should monitor vendor communications for updates. Until a patch is available, restricting remote access to the device's management interface and disabling any unnecessary services may reduce exposure. Avoid exposing the device's CGI interface to untrusted networks.