The vulnerable CGI script cstecgi.cgi in the Totolink A8000RU firmware accepts a proto argument and passes it directly to the operating system for execution. This flaw permits an attacker to inject arbitrary shell commands into the proto field, leading to full remote code execution on the device. The impact is severe, compromising confidentiality, integrity, and availability of the affected router. The weakness is a classic command injection vulnerability (CWE-77/78).

The issue affects the Totolink A8000RU model running firmware version 7.1cu.643_b20200521. No other devices or firmware versions are listed as affected. Administrators should verify that their routers are running this specific firmware build before taking remedial action.

The CVSS score of 9.3 reflects high exploitation risk. The EPSS score is not available, but the vulnerability is publicly documented and the exploit is reported as publicly available. The vulnerability can be triggered remotely without authentication, and the attacker can send a crafted request to the /cgi-bin/cstecgi.cgi endpoint to execute arbitrary commands. The lack of awareness of a KEV listing does not reduce the urgency, as the public exploits imply a realistic threat.