This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. It arises from improper input validation in the setUrlFilterRules function of the /cgi-bin/cstecgi.cgi CGI handler, specifically through the 'enable' parameter. An attacker can remotely inject OS commands, leading to potential full system compromise. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication. This can lead to complete compromise of the router, including unauthorized control, data theft, or disruption of network services. The high CVSS score reflects the critical nature and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected users should consider disabling remote management features if possible or isolating the device from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.