This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. The issue is an OS command injection in the setWiFiAclRules function of the CGI handler script (/cgi-bin/cstecgi.cgi). By manipulating the 'mode' parameter, an unauthenticated remote attacker can execute arbitrary operating system commands on the device. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. Exploit code has been published, increasing the risk of exploitation. No official patch or vendor advisory is currently available, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data exposure, or disruption of network services. The high CVSS score reflects the critical nature and ease of exploitation. No confirmed exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should monitor vendor communications for updates. As a precaution, restrict network access to the router's management interface and disable remote administration if enabled until a patch is released.