The Totolink A8000RU router version 7.1cu.643_b20200521 contains an OS command injection vulnerability (CVE-2026-9385) in its Web Management Interface, specifically in the setTracerouteCfg function of /cgi-bin/cstecgi.cgi. This vulnerability arises from improper handling of the 'command' argument, allowing remote attackers to execute arbitrary OS commands without authentication. The vulnerability is remotely exploitable with no user interaction required and has been publicly disclosed. The CVSS 4.0 base score is 9.3, reflecting critical impact and high exploitability. No official patch or remediation has been documented, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the affected device. This could lead to full compromise of the router, including unauthorized control, data interception, or disruption of network services. Given the critical CVSS score and remote exploitability, the impact on affected systems is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management interfaces or restricting access to trusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.