This vulnerability exists in the Totolink A8000RU router firmware 7.1cu.643_b20200521 within the CGI handler component, specifically the setUrlFilterRules function in /cgi-bin/cstecgi.cgi. By manipulating the 'enable' parameter, an attacker can perform OS command injection remotely, leading to potential full system compromise. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data interception, or disruption of network services relying on the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected users should consider disabling remote management interfaces if possible or isolating the device from untrusted networks to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.