This vulnerability affects the Totolink A8000RU router firmware version 7.1cu.643_b20200521. The issue lies in the setL2tpServerCfg function of the /cgi-bin/cstecgi.cgi file, part of the device's web management interface. By manipulating the 'enable' parameter, an unauthenticated remote attacker can perform OS command injection, potentially leading to full system compromise. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly known with an exploit published, but no vendor patch or official remediation level has been disclosed.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands on the affected device. This can lead to full compromise of the router, including unauthorized control, data disclosure, and disruption of network services. The critical CVSS score reflects the high impact on confidentiality, integrity, and availability of the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's web management interface from untrusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.