This vulnerability involves an OS command injection in the setUpgradeFW function of the Totolink A8000RU router's web management interface. Specifically, the resetFlags argument can be manipulated remotely without authentication to execute arbitrary operating system commands. The affected firmware version is 7.1cu.643_b20200521. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows a remote unauthenticated attacker to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data interception, or disruption of network services. The high CVSS score reflects the critical nature of this vulnerability and the potential for severe impact on device security and network integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the router's web management interface from untrusted networks and monitor for unusual activity. Avoid exposing the management interface to the internet. Follow updates from Totolink for any official patches or mitigations.