This vulnerability involves an OS command injection in the Totolink A8000RU router firmware 7.1cu.643_b20200521. Specifically, the setAdvancedInfoShow function in the CGI handler (/cgi-bin/cstecgi.cgi) improperly handles the tty_server argument, allowing remote attackers to inject and execute arbitrary operating system commands. The vulnerability requires no privileges or user interaction and can be exploited over the network. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch has been disclosed by the vendor at this time.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data disclosure, or disruption of network services. The vulnerability is critical due to its remote exploitability without authentication and its high impact on system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management features if possible or restricting access to the device's management interface to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available.