This vulnerability exists in the Totolink A8000RU router firmware version 7.1cu.643_b20200521 within the web management interface component. The setDdnsCfg function improperly sanitizes the 'provider' parameter, enabling remote OS command injection. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Exploit code is publicly available, but there is no vendor-provided patch or mitigation information at this time.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data exposure, or disruption of network services. The high CVSS score reflects the critical nature and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's web management interface from untrusted networks and consider disabling remote management features if possible. Monitor vendor channels for updates and apply patches promptly once available.