This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521 in the web management interface's UploadOpenVpnCert function. By controlling the FileName parameter, an unauthenticated remote attacker can perform OS command injection, allowing arbitrary command execution on the device. The vulnerability is remotely exploitable without authentication or user interaction, making it highly critical. Although the exploit details have been publicly disclosed, there is no vendor-provided patch or official remediation at this time. The vulnerability is not related to a cloud service and no known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This could result in unauthorized control over network traffic, device configuration, and further pivoting within the victim's network. Given the critical CVSS score and the nature of the vulnerability, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the router's web management interface from untrusted networks and monitor for any unusual activity. Avoid exposing the management interface to the internet. Follow vendor channels closely for updates on patches or mitigations.