This vulnerability exists in the Totolink A8000RU router firmware version 7.1cu.643_b20200521. The flaw is located in the CGI handler component, specifically in the setVpnAccountCfg function of the /cgi-bin/cstecgi.cgi file. An attacker can manipulate the User parameter to inject operating system commands, leading to remote code execution. The vulnerability requires no privileges or user interaction and has a CVSS 4.0 base score of 9.3, indicating critical severity. Although an exploit is publicly known, there is no vendor-provided patch or official remediation at this time.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control over network traffic, data interception, or further attacks within the network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote access to the affected CGI endpoint if possible or isolating the device from untrusted networks to reduce exposure.