This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. The issue lies in the setRemoteCfg function of the /cgi-bin/cstecgi.cgi component of the Web Management Interface. By manipulating the 'enable' parameter, an attacker can perform OS command injection remotely without requiring privileges or user interaction. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed with exploit code available, but no vendor patch or official remediation has been announced.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control over network traffic, data interception, or further attacks on connected systems. The vulnerability requires no authentication and can be triggered remotely, increasing its risk. However, there are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the router's Web Management Interface from untrusted networks, disable remote management if possible, and monitor for unusual activity. Avoid exposing the device management interface directly to the internet. Follow updates from Totolink for any forthcoming patches or official mitigations.