This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. The issue is an OS command injection in the web management interface's setMacFilterRules function, specifically in the handling of the 'enable' argument in /cgi-bin/cstecgi.cgi. Because the input is not properly sanitized, remote attackers can execute arbitrary operating system commands on the device without authentication. The CVSS 4.0 score of 9.3 reflects the vulnerability's critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full compromise of the router. This can result in unauthorized control, data interception, or disruption of network services. The vulnerability is critical given the ease of remote exploitation and the high impact on device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the router's web management interface from untrusted networks to reduce exposure. Monitor for any updates from Totolink regarding patches or mitigations. Avoid using the affected firmware version if possible.