This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. The issue lies in the CGI handler's setTelnetCfg function, which processes the telnet_enabled parameter insecurely, leading to OS command injection. The attack vector is network-based with no privileges or user interaction required, making it highly critical. The CVSS 4.0 base score is 9.3, reflecting the ease of exploitation and high impact on confidentiality, integrity, and availability. No official fix or mitigation has been documented, and the device is not a cloud service, so remediation depends on vendor action or user intervention.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication, potentially leading to full compromise of the router. This can impact device confidentiality, integrity, and availability. The vulnerability is critical given the remote, unauthenticated attack vector and high CVSS score. No known active exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management features if possible, restrict network access to the device, or replace the device with a secure alternative. Monitor vendor channels for updates and apply patches promptly once available.