This vulnerability affects the Totolink A8000RU router firmware version 7.1cu.643_b20200521. The issue lies in the web management interface's setOpenVpnCertGenerationCfg function, where improper input validation of the 'servername' parameter allows remote attackers to perform OS command injection. The vulnerability is remotely exploitable without authentication, with a CVSS 4.0 base score of 9.3 indicating critical severity. No official fix or patch has been documented, and while an exploit is publicly available, there are no known reports of exploitation in the wild.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication. This can lead to full compromise of the router, potentially affecting network traffic, device configuration, and overall network security. The critical CVSS score reflects the high impact and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the router's web management interface from untrusted networks and consider disabling the OpenVPN certificate generation feature if possible. Monitor vendor channels for updates and apply patches promptly once available.