This vulnerability allows unauthenticated remote attackers to perform OS command injection via the 'enable' parameter in the setGameSpeedCfg function of the /cgi-bin/cstecgi.cgi component in Totolink A8000RU firmware version 7.1cu.643_b20200521. The injection occurs in the Web Management Interface, enabling execution of arbitrary commands on the underlying operating system. The vulnerability has a CVSS 4.0 base score of 9.3, reflecting its critical severity and ease of exploitation without privileges or user interaction. Public exploit code is available, increasing the risk of attack. No official patch or remediation has been disclosed by the vendor as of the published date.

Successful exploitation results in remote OS command execution on the affected device without authentication, potentially allowing full control over the router. This can lead to compromise of network traffic, device configuration, and further lateral attacks within the network. The critical CVSS score reflects the high impact and exploitability of this vulnerability. No known active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the Web Management Interface from untrusted networks, disable remote management if enabled, and monitor for unusual device behavior. Users should stay alert for vendor updates providing an official patch or mitigation.