The Totolink A8000RU router firmware 7.1cu.643_b20200521 contains an OS command injection vulnerability in the setTracerouteCfg function of the /cgi-bin/cstecgi.cgi web management interface. An attacker can remotely supply crafted input to the command argument, leading to arbitrary OS command execution without authentication. The vulnerability has a CVSS 4.0 base score of 9.3 (critical), indicating high impact and ease of exploitation. Public disclosure of the exploit code is available, but no vendor patch or official remediation has been announced.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data interception, or disruption of network services relying on the device. The high CVSS score reflects the critical nature and remote exploitability of this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling remote access to the web management interface or restricting access to trusted networks only. Monitor vendor communications for updates and apply patches promptly once available.