The Totolink A8000RU router firmware 7.1cu.643_b20200521 contains an OS command injection vulnerability in the setDmzCfg function of the /cgi-bin/cstecgi.cgi CGI handler. By manipulating the wanIdx parameter, an attacker can inject and execute arbitrary operating system commands remotely without authentication. This vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published by the vendor as of the vulnerability disclosure date.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control over network traffic, data interception, or disruption of network services. The vulnerability is exploitable without authentication and requires no user interaction, increasing the risk of automated or widespread attacks. However, no confirmed exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, network administrators should consider restricting access to the router's management interface from untrusted networks and monitor for suspicious activity. Avoid exposing the device's CGI interface to the internet. Follow vendor channels closely for updates or patches addressing this vulnerability.