The Totolink A8000RU router firmware 7.1cu.643_b20200521 contains an OS command injection vulnerability in the setQosCfg function within the /cgi-bin/cstecgi.cgi web management interface. By manipulating the 'enable' parameter, an unauthenticated remote attacker can inject and execute arbitrary operating system commands. This vulnerability allows full control over the affected device and is rated critical with a CVSS 4.0 score of 9.3. No vendor advisory or patch information is currently available, and the exploit code has been publicly disclosed.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full system compromise. This can result in unauthorized control over the router, disruption of network services, and further attacks on connected networks or devices. The vulnerability is critical due to its remote, unauthenticated nature and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the router's web management interface from untrusted networks and consider disabling remote management features if possible. Monitor vendor channels for updates and apply patches promptly once available.