This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. It arises from improper input validation in the CsteSystem function within the /cgi-bin/cstecgi.cgi CGI handler component. By manipulating the HTTP argument, an attacker can inject and execute arbitrary operating system commands remotely. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official fix or patch has been disclosed by the vendor, and the exploit is publicly available.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data theft, disruption of network services, or further attacks on connected networks. The vulnerability requires no authentication and can be triggered remotely, increasing the risk of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management features if enabled, restrict access to the device's management interface to trusted networks, and monitor for unusual device behavior. Avoid exposing the device's management interface to the internet. Follow updates from Totolink for any official patches or mitigations.