This vulnerability affects the Totolink A8000RU router firmware version 7.1cu.643_b20200521. It is an OS command injection flaw in the setScheduleCfg function of the /cgi-bin/cstecgi.cgi component of the Web Management Interface. By manipulating the 'mode' parameter, an unauthenticated remote attacker can execute arbitrary operating system commands on the device. The vulnerability is remotely exploitable without any privileges or user interaction. Public exploit code is available, but there is no vendor-provided patch or official remediation information at this time.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the affected device. This can lead to full compromise of the router, including control over network traffic, device configuration, and potential pivoting to internal networks. The vulnerability is critical due to its remote, unauthenticated nature and high CVSS score of 9.3. Although no exploits in the wild are currently confirmed, public exploit code availability increases the risk of attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling remote access to the Web Management Interface or restricting access to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available.