This vulnerability allows remote attackers to perform OS command injection via the 'enable' parameter in the setStaticDhcpRules function of the Totolink A8000RU's web management interface CGI script (/cgi-bin/cstecgi.cgi). The affected version is 7.1cu.643_b20200521. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Exploit code is publicly available, but no official patch or mitigation has been disclosed by the vendor.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication, potentially leading to full compromise of the router, including unauthorized access, configuration changes, or disruption of service. The high CVSS score reflects the critical nature and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the router's web management interface from untrusted networks and consider disabling remote management features if possible. Monitor vendor communications for updates and apply patches promptly once available.