This vulnerability affects the Totolink A8000RU router firmware version 7.1cu.643_b20200521. It is caused by improper input validation in the UploadFirmwareFile function of the /cgi-bin/cstecgi.cgi web management interface component. Specifically, the FileName parameter can be manipulated to inject and execute arbitrary operating system commands remotely without authentication. The vulnerability has been publicly disclosed and carries a CVSS 4.0 base score of 9.3, reflecting its critical severity and ease of remote exploitation. No official patch or remediation level has been provided by the vendor as of the publication date.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control over the device, disruption of network services, and further attacks on connected networks or devices. The vulnerability is critical due to its remote, unauthenticated nature and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict remote access to the web management interface, disable remote management if possible, and monitor for unusual activity. Users should stay alert for vendor updates and apply patches promptly once available.