The vulnerability resides in the setWiFiAclRules function of the /cgi-bin/cstecgi.cgi CGI handler. Manipulation of the "mode" argument allows an attacker to inject arbitrary operating‑system commands, leading to full remote code execution on the affected router. This flaw can compromise network confidentiality, integrity, and availability if exploited, as it gives the attacker control over the device and the Ability to alter its configuration or use it as a foothold into the local network.

The flaw affects Totolink A8000RU routers running firmware version 7.1cu.643_b20200521. No other versions or product variants have been documented as impacted.

The CVSS score of 9.3 indicates a critical severity. Although an EPSS score is not available, the vulnerability is actively exploited as the exploit has been publicly released, and the document notes that the attack can be carried out remotely. Because the flaw is exposed through a publicly reachable CGI endpoint and no authentication is required for the vulnerable parameter, any remote host with network access to the router can potentially trigger command injection and take full control of the device. The absence of a KEV listing does not diminish the risk, as exploitation is already demonstrated in the wild.