This vulnerability affects the Totolink A8000RU router firmware 7.1cu.643_b20200521. It arises from improper input validation in the setAccessDeviceCfg function within the /cgi-bin/cstecgi.cgi web management CGI script. By manipulating the mac argument, an unauthenticated remote attacker can perform OS command injection, potentially gaining control over the device. The vulnerability is remotely exploitable without authentication and does not require user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or mitigation has been documented as of the publication date.

Successful exploitation allows a remote attacker to execute arbitrary operating system commands on the affected device without authentication. This can lead to full compromise of the router, including unauthorized access, control over network traffic, and potential pivoting to internal networks. The critical CVSS score of 9.3 reflects the severe impact on confidentiality, integrity, and availability of the device and connected networks. No known exploitation in the wild has been confirmed yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the web management interface from untrusted networks and monitor for unusual activity. Avoid exposing the device management interface directly to the internet. Follow vendor channels closely for updates and apply patches promptly once released.