This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. It is an OS command injection issue in the web management interface component, specifically in the setWiFiAdvancedCfg function within /cgi-bin/cstecgi.cgi. Attackers can manipulate the bgProtection parameter to inject and execute arbitrary operating system commands remotely without any authentication or user interaction. The vulnerability has been publicly disclosed with an exploit available, and it carries a critical severity rating with a CVSS 4.0 score of 9.3, indicating high impact and ease of exploitation. No official patch or remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full compromise of the router. This can result in unauthorized control over network traffic, device configuration, and further attacks on connected systems. The vulnerability's critical severity and public exploit availability increase the risk of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the router's web management interface from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.