A flaw in the setWiFiBasicCfg function of the /cgi-bin/cstecgi.cgi script allows an attacker to inject arbitrary operating‑system commands by manipulating the wifiOff argument. The vulnerability can be triggered remotely via standard HTTP requests and, once exploited, gives the attacker full control over the router’s operating system, enabling persistence, data exfiltration, or pivoting into the local network.

The flaw is present in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The affected vendor is Totolink, model A8000RU, and the issue has been documented for this specific firmware build. Users of this model should verify whether their firmware matches the affected version and determine whether newer releases contain the fix.

The CVSS score of 9.3 marks this as a critical weakness with a high likelihood of exploitation. Although the EPSS score is currently unavailable, the public release of a working exploit and the lack of a patch in the KEV catalog point to a real and immediate threat. The weakest access requirement is remote network connectivity to the router’s web interface or administration endpoints, making the attack vector easily exploitable from outside the local network.