A command injection flaw exists in the setUrlFilterRules function of /cgi-bin/cstecgi.cgi on the Totolink A8000RU router. By manipulating the enable argument, an attacker can execute arbitrary operating‑system commands on the device. The weakness is an instance of CWE‑77 and CWE‑78, allowing the attacker to gain complete control of the router’s operating system. Remote exploitation is possible because the vulnerable CGI endpoint is exposed over the network, and an exploit has already been released to the public.

The vulnerability affects Totolink A8000RU units running firmware version 7.1cu.643_b20200521. Users of this model and firmware revision must verify whether they are running the affected build.

The CVSS score of 9.3 indicates critical severity, and while EPSS data is not currently available, the public release of an exploitation script demonstrates that the flaw is actively being used. The vulnerability is not listed in the CISA KEV catalog, but the remote nature of the attack and the availability of a working exploit mean that risk to impacted systems is high. Attackers must be able to reach the router over the network to send crafted requests to /cgi-bin/cstecgi.cgi; no local privilege escalation is required in order to trigger the vulnerability.