This vulnerability affects the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. It arises from improper input handling in the CsteSystem function of the CGI handler component, specifically in the /cgi-bin/cstecgi.cgi file. An attacker can remotely supply crafted HTTP arguments to trigger OS command injection, potentially allowing full control over the device's operating system. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication. This can lead to full compromise of the router, including unauthorized access, data manipulation, or disruption of network services. The vulnerability's critical severity and high CVSS score reflect its potential to cause severe impact on device security and network integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected device's management interface to trusted sources only and monitor for unusual activity. Avoid exposing the device's CGI interface to untrusted networks. Follow updates from Totolink for any forthcoming patches or official mitigations.