This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521 and is located in the setIpv6LanCfg function of the /cgi-bin/cstecgi.cgi CGI handler. By manipulating the addrPrefixLen parameter, an attacker can perform OS command injection remotely without authentication or user interaction. The CVSS 4.0 base score is 9.3 (critical), reflecting the high impact and ease of exploitation. The vulnerability is publicly disclosed but currently lacks an official fix or patch from the vendor. The affected product is not a cloud service, so remediation depends on vendor patching or user firmware updates.

Successful exploitation of this vulnerability allows remote, unauthenticated attackers to execute arbitrary operating system commands on the affected device. This can lead to full compromise of the router, including control over network traffic and device configuration. The high CVSS score (9.3) indicates critical impact with no required privileges or user interaction. The exploit is publicly known, increasing the risk of attack, although no active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been published by Totolink, users should monitor for firmware updates addressing this vulnerability. Until a patch is available, consider limiting remote access to the device's management interface and applying network-level controls to restrict exposure. Avoid exposing the affected CGI interface to untrusted networks.