This vulnerability affects the Totolink A8000RU router firmware version 7.1cu.643_b20200521. The flaw exists in the web management interface's setL2tpServerCfg function, where manipulation of the 'enable' parameter can lead to OS command injection. The attack vector is remote and requires no privileges or user interaction. The CVSS v4.0 base score is 9.3, indicating critical severity due to network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. No official remediation or patch is currently documented.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control over network traffic, data interception, or disruption of network services. The vulnerability does not require authentication or user interaction, increasing its risk. Although exploit code is publicly available, there are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the router's web management interface from untrusted networks and monitor for unusual activity. Avoid exposing the management interface to the internet. Follow vendor channels closely for updates and apply patches promptly once available.