A flaw in the router’s CGI handler allows an attacker to manipulate the merge argument of the setWiFiEasyGuestCfg function, which results in an OS command injection. By submitting a crafted HTTP request to the /cgi-bin/cstecgi.cgi endpoint, the attacker can execute arbitrary commands with the privileges of the device’s firmware, potentially taking full control of the router and any traffic passing through it. The weakness corresponds to CWE‑77 (Command Injection) and CWE‑78 (OS Command Injection).

The vulnerability affects Totolink A8000RU routers that are running firmware version 7.1cu.643_b20200521. Owners of this build should check with Totolink for newer firmware releases that contain the fix.

The CVSS score of 9.3 indicates critical severity, and the EPSS score of less than 1% suggests that exploitation is expected to occur infrequently. Nevertheless, the flaw has been publicly released and, based on the description, it is inferred that authentication is not required. Attackers can trigger the injection from any remote location by sending a request to the CGI endpoint, and because the command is executed with firmware privileges, the potential impact includes complete device compromise. The vulnerability is not listed in the CISA KEV catalog, but that does not mitigate the risk.