This vulnerability exists in the Totolink A8000RU router firmware version 7.1cu.643_b20200521 within the web management interface component. The setRemoteCfg function in /cgi-bin/cstecgi.cgi improperly sanitizes the 'enable' parameter, enabling remote attackers to perform OS command injection. The attack requires no privileges or user interaction and can be executed over the network. The CVSS 4.0 base score is 9.3, indicating critical severity with high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published by the vendor, and the device is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication, potentially leading to full compromise of the router. This can result in unauthorized control, data interception, or disruption of network services. The vulnerability has a CVSS 4.0 score of 9.3, reflecting critical impact on system confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users should monitor Totolink's official channels for updates. Until a patch is available, restricting access to the router's web management interface from untrusted networks and disabling remote management features, if possible, may reduce exposure.