This vulnerability exists in the Totolink A8000RU router firmware version 7.1cu.643_b20200521 within the web management interface component. The setStaticDhcpRules function improperly sanitizes the 'enable' argument, enabling remote attackers to perform OS command injection. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Exploit code is publicly available, increasing the risk of exploitation. No official patch or vendor advisory has been published to date.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication, potentially leading to full compromise of the router, including control over network traffic and device configuration. This can severely impact confidentiality, integrity, and availability of the device and connected networks.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, affected users should consider disabling remote management interfaces or restricting access to trusted networks to reduce exposure.