This vulnerability affects the Totolink A8000RU router running firmware 7.1cu.643_b20200521. It allows unauthenticated remote attackers to perform OS command injection via the 'enable' parameter in the setGameSpeedCfg function within the /cgi-bin/cstecgi.cgi web management interface. The issue enables execution of arbitrary commands on the underlying operating system, posing a critical security risk. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided by the vendor as of the published date. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication, potentially leading to full compromise of the router. This can result in unauthorized control, data interception, or disruption of network services. The vulnerability is rated critical with a CVSS score of 9.3, reflecting the high potential impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor Totolink's official channels for firmware updates addressing this issue. Until a patch is available, consider restricting access to the router's web management interface from untrusted networks to reduce exposure.