The Totolink A8000RU router firmware version 7.1cu.643_b20200521 contains an OS command injection vulnerability in the setLanguageCfg function of the /cgi-bin/cstecgi.cgi component of its Web Management Interface. By manipulating the 'lang' parameter, a remote unauthenticated attacker can inject and execute arbitrary operating system commands. This vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 9.3, reflecting its critical severity. No official patch or remediation level has been disclosed, and the vendor has not provided advisory details or fixes. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full compromise of the router. This can result in unauthorized control over network traffic, device configuration, and further attacks on connected systems. The vulnerability affects a specific firmware version of the Totolink A8000RU router. There are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling remote access to the Web Management Interface or restricting access to trusted networks only. Monitor vendor channels for updates and apply patches immediately once available. Avoid exposing the affected device's management interface to untrusted networks.