An OS command injection flaw exists in the setTelnetCfg function of the /cgi-bin/cstecgi.cgi CGI handler on Totolink A8000RU routers running firmware 7.1cu.643_b20200521. The flaw allows an attacker to inject arbitrary shell commands by manipulating the telnet_enabled argument. Exploiting this vulnerability can lead to full compromise of the device, granting an attacker the ability to execute commands with the privileges of the router’s operating system.

The vulnerability affects the Totolink A8000RU router, specifically firmware version 7.1cu.643_b20200521 and potentially earlier releases that have not applied the patch.

The CVSS score is 9.3, indicating critical severity. The EPSS score is not available, but the public availability of the exploit and the lack of KEV listing suggest that the vulnerability is actively exploitable. Attackers can reach the vulnerable component remotely, likely over the network, and trigger command injection via the telnet_enabled parameter. Because the flaw permits arbitrary command execution without authentication, once remote access is achieved, the attacker can gain full control of the device.