This vulnerability exists in the Totolink A8000RU router firmware 7.1cu.643_b20200521 within the CGI handler component, specifically in the setWiFiWpsStart function. By manipulating the wscDisabled parameter, an unauthenticated remote attacker can perform OS command injection, potentially leading to full system compromise. The vulnerability is remotely exploitable without any privileges or user interaction. The CVSS 4.0 score of 9.3 reflects the critical nature of this flaw. No official patch or vendor advisory is currently available, and no exploits have been confirmed in the wild.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication, potentially leading to full control over the router. This can compromise network security and availability. The vulnerability is critical due to its ease of exploitation and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's management interface from untrusted networks and disable WPS functionality if possible to reduce exposure.