A command injection flaw exists in the setPptpServerCfg function of the /cgi-bin/cstecgi.cgi CGI handler in Totolink A8000RU firmware 7.1cu.643_b20200521. By manipulating the enable argument, an attacker can inject arbitrary operating‑system commands, resulting in full remote code execution on the device. This weakness is classified under CWE‑77 (OS Command Injection) and CWE‑78 (OS Command Injection), highlighting insufficient validation of user‑supplied input that is passed to system calls.

The vulnerability impacts the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. No other vendors, products, or versions are listed as affected.

The flaw carries a CVSS score of 9.3, signifying critical severity, and an EPSS score of < 1%, indicating a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack may be initiated remotely by sending a crafted HTTP request to the router’s cstecgi.cgi endpoint. Because the command injection is executed within the context of the router’s operating system, an attacker who succeeds can compromise the device’s integrity, confidentiality, and availability, potentially gaining full control of the network.