This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. The issue is located in the CGI handler component, specifically in the setPptpServerCfg function of the /cgi-bin/cstecgi.cgi file. By manipulating the 'enable' parameter, an attacker can perform OS command injection remotely without any privileges or user interaction. The vulnerability has been publicly disclosed and carries a critical severity rating with a CVSS 4.0 score of 9.3, indicating a high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication. This can lead to full compromise of the device, including unauthorized control, data manipulation, or disruption of service. The vulnerability impacts confidentiality, integrity, and availability with high severity. There are no known exploits in the wild at this time, but public disclosure increases the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable service or restricting access to the device's management interface to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available.