This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. The issue lies in the setTelnetCfg function of the /cgi-bin/cstecgi.cgi CGI handler, where improper sanitization of the telnet_enabled parameter leads to OS command injection. This allows remote attackers to execute arbitrary commands on the underlying operating system without authentication or user interaction. The CVSS 4.0 base score is 9.3 (critical), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation enables remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized access, data disclosure, device manipulation, or denial of service. The vulnerability has a critical severity rating with a CVSS 4.0 score of 9.3, indicating a severe impact on confidentiality, integrity, and availability. No known exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor Totolink's official channels for updates. Until a patch is available, consider restricting network access to the device's management interface to trusted hosts only and disable Telnet services if possible to reduce exposure.