This vulnerability exists in the Totolink A8000RU router firmware 7.1cu.643_b20200521, specifically in the web management interface component. The setDiagnosisCfg function in /cgi-bin/cstecgi.cgi improperly handles the 'ip' argument, allowing an unauthenticated remote attacker to perform OS command injection. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Exploit code is publicly available, increasing the risk of exploitation. No vendor patch or official remediation has been documented as of the publication date.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands on the affected device. This can lead to full compromise of the router, including unauthorized access, data interception, device control, or disruption of network services. The critical CVSS score reflects the high potential impact on confidentiality, integrity, and availability of the device and connected network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the router's web management interface from untrusted networks and monitor for any unusual activity. Consider disabling remote management features if enabled. Follow updates from Totolink for any forthcoming patches or official mitigations.