This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. The issue lies in the CGI handler component, specifically the setWiFiEasyCfg function in /cgi-bin/cstecgi.cgi. By manipulating the 'merge' argument, an attacker can perform OS command injection remotely without any privileges or user interaction. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Exploits are publicly available, increasing the risk of exploitation. No vendor patch or official fix has been documented yet.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control over network traffic, data interception, or further attacks on internal networks. The vulnerability requires no authentication and can be exploited remotely, significantly increasing the threat level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management interfaces if enabled, restrict access to the device's management interface to trusted networks, and monitor for unusual activity. Avoid exposing the device directly to untrusted networks. Follow vendor channels closely for updates and apply patches promptly once available.