This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. The issue is located in the CGI handler component, specifically in the setWiFiAclRules function of /cgi-bin/cstecgi.cgi. By manipulating the 'mode' argument, an attacker can perform OS command injection remotely without any privileges or user interaction. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor or authoritative sources.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data theft, or disruption of network services. The vulnerability does not require authentication or user interaction, increasing its risk. No known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting remote access to the device's management interface and monitor for unusual activity. Avoid exposing the device's CGI interfaces to untrusted networks. Follow vendor communications closely for updates on patches or official mitigations.