This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. The issue lies in the CGI handler component, specifically the setNtpCfg function within /cgi-bin/cstecgi.cgi. By manipulating the tz argument, an attacker can inject OS commands that the system executes, enabling remote code execution without any privileges or user interaction. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, reflecting its network attack vector, no required privileges, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the exploit code is publicly known.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data interception, or disruption of network services. The vulnerability requires no authentication and no user interaction, increasing the risk of widespread exploitation. However, there are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote access to the affected CGI interface if possible or isolate the device from untrusted networks. Monitor vendor communications for updates and apply patches promptly once available.