This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. It arises from improper input validation in the CsteSystem function within the /cgi-bin/cstecgi.cgi CGI handler, allowing an attacker to inject OS commands via the HTTP argument. The vulnerability can be exploited remotely without any privileges or user interaction, leading to high impact on confidentiality, integrity, and availability. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on all security properties. No official patch or remediation level has been published by the vendor, and the device is not a cloud service, so remediation depends on vendor firmware updates. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data theft, disruption of network services, or use of the device as a pivot point for further attacks. The vulnerability affects confidentiality, integrity, and availability with high severity as reflected by the CVSS 9.3 score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, affected users should monitor Totolink's official channels for firmware updates addressing this issue. Until a patch is available, consider restricting network access to the device's management interface to trusted hosts only and disable remote management features if possible to reduce exposure.