This vulnerability involves an OS command injection in the Totolink A8000RU router firmware 7.1cu.643_b20200521. Specifically, the setMiniuiHomeInfoShow function in the /cgi-bin/cstecgi.cgi CGI handler improperly sanitizes the sys_info argument, enabling remote attackers to inject and execute arbitrary operating system commands. The attack vector is network-based with no privileges or user interaction required, making it highly accessible. The CVSS 4.0 score of 9.3 indicates critical impact with high exploitability. No official remediation or patch has been documented, and the vendor has not provided a fix or advisory. The exploit code has been publicly disclosed, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication or user interaction. This can lead to full compromise of the router, including control over network traffic, device configuration, and potential pivoting to internal networks. The critical CVSS score reflects the high impact and ease of exploitation. No known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management interfaces if possible and restrict network access to the device. Monitor vendor channels for updates. No official patch or temporary fix is currently available.