This vulnerability in Totolink A8000RU firmware 7.1cu.643_b20200521 allows remote attackers to perform OS command injection via the tty_server argument in the setAdvancedInfoShow function of the /cgi-bin/cstecgi.cgi CGI handler. The flaw enables execution of arbitrary commands on the underlying operating system without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data exposure, disruption of network services, or use of the device as a pivot point for further attacks. The vulnerability is critical due to its remote, unauthenticated nature and high impact on system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote access to the affected CGI interface if possible or isolate the device from untrusted networks. Monitor vendor channels for updates and apply patches promptly once available.