This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. The issue lies in the setAppFilterCfg function of the /cgi-bin/cstecgi.cgi CGI script, where improper handling of the 'enable' parameter leads to OS command injection. An attacker can remotely supply crafted input to execute arbitrary operating system commands on the device without requiring privileges or user interaction. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed with an available exploit, but no vendor patch or mitigation guidance has been provided yet.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data interception, or disruption of network services. The vulnerability is critical due to its remote, unauthenticated nature and high impact on device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the device's management interface from untrusted networks and monitoring for suspicious activity. Avoid exposing the device's CGI interfaces directly to the internet.