This vulnerability exists in the Totolink A8000RU router firmware version 7.1cu.643_b20200521 within the web management interface component. The setOpenVpnCfg function improperly sanitizes user-supplied input, enabling remote attackers to perform OS command injection via crafted arguments. This flaw allows execution of arbitrary commands on the underlying operating system with no user interaction or privileges required. The vulnerability is publicly known and classified as critical with a CVSS 4.0 score of 9.3, reflecting network attack vector, no required privileges, and high impact on confidentiality, integrity, and availability. No vendor patch or official remediation has been published as of the data provided.

Successful exploitation can lead to full compromise of the affected device, allowing attackers to execute arbitrary operating system commands remotely without authentication. This can result in unauthorized control over the router, potentially leading to network disruption, data interception, or further attacks within the network environment. The high CVSS score reflects the critical nature and ease of exploitation. Although the exploit is publicly available, no confirmed exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management interfaces or restricting access to trusted networks to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available. Avoid exposing the affected device directly to untrusted networks.