This vulnerability involves an OS command injection in the Totolink A8000RU router's CGI handler component. Specifically, the setWiFiEasyGuestCfg function improperly sanitizes the 'merge' argument, enabling remote attackers to inject and execute arbitrary operating system commands. The vulnerability affects firmware version 7.1cu.643_b20200521 and can be exploited remotely without privileges or user interaction. The CVSS 4.0 base score is 9.3, indicating critical severity. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control over network traffic, device configuration, and could facilitate further attacks within the network environment. The vulnerability is critical due to its remote, unauthenticated nature and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected users should consider disabling remote management features if possible and restrict network access to the device's management interfaces. Monitor vendor communications for updates regarding patches or official mitigations.