This vulnerability affects the Totolink A8000RU router firmware version 7.1cu.643_b20200521. The issue is an OS command injection in the setScheduleCfg function of the /cgi-bin/cstecgi.cgi component of the Web Management Interface. By manipulating the 'mode' argument remotely, an attacker can execute arbitrary operating system commands on the device. The vulnerability is remotely exploitable without authentication or user interaction, and it has a CVSS 4.0 base score of 9.3, reflecting critical severity. Public exploit code is available, but no official patch or remediation level has been disclosed by the vendor. The device is not cloud-hosted, so remediation requires firmware updates from Totolink.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full device compromise. This can result in unauthorized control over the router, disruption of network services, or further attacks on connected networks. The vulnerability's critical CVSS score and public exploit availability increase the urgency of addressing this issue.

As of the published date, no official patch or remediation has been announced by Totolink. Users should monitor the vendor's advisory channels for firmware updates addressing this vulnerability. In the absence of a patch, restricting remote access to the Web Management Interface and disabling remote management features can reduce exposure. Since the device is not cloud-hosted, remediation depends on applying vendor firmware updates once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.