This vulnerability involves an OS command injection in the web management interface of the Totolink A8000RU router, specifically in the setParentalRules function within /cgi-bin/cstecgi.cgi. By manipulating the 'enable' parameter, a remote attacker can execute arbitrary operating system commands on the device without authentication or user interaction. The affected firmware version is 7.1cu.643_b20200521. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Although exploit code is publicly available, no active exploitation has been confirmed. No official remediation or patch has been documented as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can impact confidentiality, integrity, and availability of the device and the network it serves. Given the critical CVSS score of 9.3, the vulnerability poses a severe risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management interfaces if possible or restricting access to trusted networks. Monitor Totolink's official channels for updates and apply any available firmware updates promptly once released.