This vulnerability involves OS command injection in the setDiagnosisCfg function of the /cgi-bin/cstecgi.cgi file within the web management interface of Totolink A8000RU firmware version 7.1cu.643_b20200521. By manipulating the 'ip' parameter, an unauthenticated remote attacker can execute arbitrary operating system commands on the device. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 9.3, reflecting its critical impact. No official remediation or patch has been published by the vendor as of the data provided. Exploit code has been made public, increasing the risk of potential attacks.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication. This can lead to full compromise of the router, including unauthorized control, data interception, or further network attacks. The vulnerability's critical CVSS score (9.3) reflects the high potential impact on confidentiality, integrity, and availability of the device and connected networks.

No official patch or remediation is currently available from the vendor. Users should monitor Totolink's official advisories for updates and apply patches promptly once released. Until then, it is recommended to restrict remote access to the web management interface, especially blocking access to /cgi-bin/cstecgi.cgi, to trusted networks only. Disabling remote management features if possible can reduce exposure. Avoid exposing the device management interface directly to the internet.