The vulnerability arises from the setVpnAccountCfg function within the cstecgi.cgi CGI handler, which processes the User input without proper sanitization. This flaw permits an attacker to inject and execute arbitrary operating system commands on the router, yielding complete command execution. The flaw aligns with the OS Command Injection weakness (CWE-77) and Command Injection (CWE-78).

Affected devices are Totolink A8000RU routers running firmware version 7.1cu.643_b20200521. The issue resides in the component known as the CGI Handler and specifically the /cgi-bin/cstecgi.cgi path. No other devices or firmware revisions are currently documented as vulnerable.

The CVSS score of 9.3 indicates a high severity, and the vulnerability can be triggered remotely without authentication. Although the EPSS score is not available, the public disclosure of an exploit suggests that adversaries may already be attempting or have access to attack tools. Because the flaw allows arbitrary command execution, any compromised router could become a pivot point for lateral movement or internet-facing exposure. The vulnerability is not listed in the CISA KEV catalog yet, but the combination of high CVSS, remote reachability, and demonstrated exploit increases the risk profile.