The vulnerability allows attackers to inject operating‑system commands through the admpass argument of the cstecgi.cgi CGI handler on the router. Manipulation of this parameter results in arbitrary shell command execution, giving the attacker full control over the device. The weakness is a classic command injection problem, indexed as CWE-77 and CWE-78, and the impact is a loss of confidentiality, integrity and availability on the affected device.

The TOTOLINK A8000RU router, specifically firmware version 7.1cu.643_b20200521, is impacted by this flaw. No other products or firmware revisions are listed in the CVE data.

The CVSS score of 9.3 signifies severe risk, and the EPSS score is not provided, making it difficult to quantify current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, but the remote nature of the attack combined with the high exploit potential raise the risk to a critical level. An attacker who can reach the router’s CGI interface from outside can use the injection to execute arbitrary commands, compromise the device, and potentially pivot to internal network assets.