This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. It is an OS command injection issue in the setFirewallType function of the /cgi-bin/cstecgi.cgi component of the Web Management Interface. By manipulating the firewallType parameter, an attacker can execute arbitrary operating system commands remotely without authentication. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no official patch or vendor advisory has been provided yet.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full system compromise. This can result in unauthorized control over the router, disruption of network services, and exposure of sensitive data handled by the device. Given the critical CVSS score and remote attack vector, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the Web Management Interface from untrusted networks, disable remote management if possible, and monitor for unusual activity. Avoid exposing the device management interface to the internet. Follow vendor communications closely for updates on patches or official mitigations.