This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. The issue is located in the CGI handler component, specifically the setRadvdCfg function in /cgi-bin/cstecgi.cgi. By manipulating the maxRtrAdvInterval parameter, an attacker can perform OS command injection remotely without any privileges or user interaction. The CVSS 4.0 base score is 9.3, reflecting its critical severity with network attack vector, no required privileges, and high impact on confidentiality, integrity, and availability. Although a public exploit exists, no official patch or vendor advisory is currently available.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data exposure, or disruption of network services. The vulnerability requires no authentication and can be triggered remotely, making it highly dangerous. However, there are no confirmed reports of exploitation in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device's management interface to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available. Avoid using the vulnerable firmware version 7.1cu.643_b20200521 if possible.