This vulnerability affects Totolink A8000RU routers running firmware version 7.1cu.643_b20200521. The issue lies in the setWiFiBasicCfg function within the CGI Handler component, where improper input validation of the wifiOff parameter in the /cgi-bin/cstecgi.cgi endpoint allows an unauthenticated remote attacker to perform OS command injection. This can lead to arbitrary command execution on the device with the privileges of the web server process. The CVSS 4.0 base score is 9.3, reflecting a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or mitigation has been documented, and the vulnerability is publicly known with a proof-of-concept exploit available.

Successful exploitation of this vulnerability allows a remote attacker to execute arbitrary operating system commands on the affected Totolink A8000RU device without authentication. This can lead to full compromise of the device, including unauthorized access to network traffic, disruption of network services, and potential pivoting to internal networks. The critical CVSS score of 9.3 indicates a severe impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management interfaces if enabled and restrict network access to the device's management interface to trusted hosts only. Monitor vendor channels for updates and apply any official patches promptly once available.