A flaw in the setAdvancedInfoShow function of Totolink A8000RU’s cstecgi.cgi allows an attacker to inject arbitrary OS commands via the tty_server parameter. The vulnerable code does not properly sanitize this input, creating a classic OS command injection weakness (CWE-77 and CWE-78). Compromise of this function grants the attacker full control over the router’s operating system, enabling installation of backdoors, data exfiltration, or service disruption. The CVE’s description notes that the exploit is publicly available and could be leveraged remotely.

The vulnerability is present in the Totolink A8000RU model running firmware 7.1cu.643_b20200521. No other firmware or model variations are listed in the advisory. Users of this specific firmware revision are therefore at risk.

The CVSS base score of 9.3 classifies this as critical, reflecting high impact, high exploitability, and network reachability. The EPSS score is not reported, but the public availability of an exploit and the remote nature of the attack suggest a high likelihood of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog, yet its presence in a widely deployed consumer router and the ease of exploitation warrant urgent attention.