This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. The issue is an OS command injection in the setWiFiBasicCfg function of the CGI handler, triggered by manipulating the wifiOff parameter in the /cgi-bin/cstecgi.cgi endpoint. The vulnerability allows unauthenticated remote attackers to execute arbitrary operating system commands, posing a critical security risk. The CVSS 4.0 base score is 9.3, reflecting its high severity and ease of exploitation. No vendor advisory or patch information is currently available.

Successful exploitation enables remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full system compromise. This can result in unauthorized control over the router, disruption of network services, and further attacks on connected networks or devices. The availability of a public exploit increases the risk of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the router's management interface from untrusted networks and consider disabling remote management features if possible. Monitor vendor channels for updates and apply patches promptly once available.