This vulnerability allows remote attackers to perform OS command injection via the 'admpass' parameter in the setLoginPasswordCfg function of the /cgi-bin/cstecgi.cgi CGI handler on Totolink A8000RU devices running firmware 7.1cu.643_b20200521. The issue arises from insufficient input validation, enabling execution of arbitrary system commands without authentication. The CVSS 4.0 base score is 9.3, reflecting high impact and ease of exploitation without privileges or user interaction. No official patch or vendor advisory is currently available, and the device is not a cloud service.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This could result in unauthorized control, data interception, or disruption of network services. The vulnerability is critical due to its remote, unauthenticated nature and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected users should consider disabling remote management interfaces if possible or restricting access to trusted networks. Monitor vendor communications for updates and apply patches promptly once available.