This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. An attacker can remotely exploit an OS command injection flaw in the setVpnAccountCfg function within the CGI Handler component by manipulating the User parameter in the /cgi-bin/cstecgi.cgi endpoint. This allows execution of arbitrary operating system commands with no authentication required. The vulnerability has been publicly disclosed and carries a CVSS 4.0 score of 9.3, indicating critical severity. No official patch or remediation level has been provided by the vendor as of the publication date.

Successful exploitation allows a remote unauthenticated attacker to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This could result in unauthorized control over network traffic, device configuration, and further network attacks. The high CVSS score reflects the critical nature and ease of exploitation without user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected device's management interface from untrusted networks and monitor for unusual activity. No vendor-provided mitigation or temporary fix is currently available.