This vulnerability exists in the Totolink A8000RU router firmware 7.1cu.643_b20200521 within the web management interface's setPasswordCfg function. By manipulating the admpass parameter, an attacker can perform OS command injection, enabling remote code execution without authentication. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data interception, or disruption of network services. The vulnerability is critical due to its ease of exploitation and high impact on device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the router's web management interface from untrusted networks to reduce exposure. Monitor for updates from Totolink regarding patches or mitigations.