The Totolink A8000RU router version 7.1cu.643_b20200521 contains an OS command injection vulnerability in the setWanCfg function within the /cgi-bin/cstecgi.cgi component of its Web Management Interface. This flaw allows an unauthenticated remote attacker to execute arbitrary operating system commands by manipulating input arguments. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published by the vendor at this time.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary OS commands on the affected device without authentication, potentially leading to full compromise of the router, disruption of network services, and unauthorized access to network traffic. The critical CVSS score reflects the high potential impact on device confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the Web Management Interface from untrusted networks and monitor for any unusual activity. Avoid exposing the management interface to the internet and consider network-level controls to limit access.