The Totolink A8000RU router firmware 7.1cu.643_b20200521 contains an OS command injection vulnerability in the CGI handler at /cgi-bin/cstecgi.cgi. Specifically, the 'proto' argument can be manipulated remotely without authentication to inject and execute arbitrary OS commands. This vulnerability has a CVSS 4.0 base score of 9.3 (critical), reflecting its ease of exploitation and severe impact on system security. The vulnerability was publicly disclosed on 2026-05-01, with a publicly available exploit, but no official patch or remediation level has been announced by Totolink. The device is not a cloud service, so remediation depends on vendor firmware updates.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in loss of confidentiality, integrity, and availability of the device and the network it serves. The vulnerability is critical due to its remote, unauthenticated nature and high impact metrics. No known exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Totolink communications for firmware updates addressing this vulnerability. Until a patch is available, consider restricting access to the device's management interface from untrusted networks to reduce exposure.