The vulnerable function setIpv6LanCfg in /cgi‑bin/cstecgi.cgi allows an attacker to manipulate the addrPrefixLen parameter, resulting in arbitrary OS command execution. An attacker can launch the attack from any remote network that can reach the router’s web interface. Successful exploitation would give the attacker full control over the underlying operating system, allowing data theft, configuration compromise, or further network intrusion.

Affected systems are Totolink A8000RU routers running firmware version 7.1cu.643_b20200521. The vulnerability originates from the CGI Handler component in the firmware.

The CVSS score of 9.3 indicates critical risk, and while no EPSS score is publicly available, the vulnerability is not listed in CISA KEV catalogs. The known public exploit demonstrates that remote attackers can inject OS commands by sending crafted requests to the CGI endpoint, underscoring the high likelihood of exploitation in environments where the router is exposed to untrusted networks.