The Totolink A8000RU router firmware 7.1cu.643_b20200521 contains an OS command injection vulnerability (CVE-2026-7202) in the CGI handler component, specifically in the setWiFiWpsStart function of /cgi-bin/cstecgi.cgi. By manipulating the wscDisabled parameter, an unauthenticated remote attacker can inject and execute arbitrary operating system commands. This vulnerability is remotely exploitable and has a CVSS 4.0 base score of 9.3, indicating critical severity. No vendor advisory or patch information is currently available, and the vulnerability state is published with public exploit disclosure.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full device compromise. This can result in unauthorized control over the router, disruption of network services, and further attacks on connected networks or devices. The high CVSS score reflects the critical nature and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling WPS functionality if possible, restrict remote management access, and isolate the device from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.