The vulnerability allows an attacker to execute arbitrary operating system commands by manipulating the wscDisabled argument in the setWiFiWpsStart function of /cgi-bin/cstecgi.cgi. This results in Remote Command Execution, as attackers can run any shell command with the privileges of the router process. The weakness is a classic OS command injection (CWE‑78) and a denial of service possibility if the command leads to resource exhaustion (CWE‑77).

Totolink A8000RU routers running firmware version 7.1cu.643_b20200521 are affected. No other versions or vendors were enumerated in the data.

The CVSS score of 9.3 indicates Critical severity, and the EPSS score is not available, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, but the public disclosure and remote nature of the attack vector make it a high-risk exposure. Attackers can exploit the flaw remotely by sending crafted requests to the router’s web interface, bypassing authentication or using default credentials, and trigger arbitrary command execution on the device.