The flaw is an OS command injection in the setDiagnosisCfg endpoint of the /cgi-bin/cstecgi.cgi script. By supplying a specially crafted value for the ip argument, an attacker can cause the firmware to execute arbitrary shell commands on the device. This allows the attacker to take full control of the router, read or modify configuration, install malware, or pivot to other devices on the network.

The vulnerable firmware version is Totolink A8000RU 7.1cu.643_b20200521. The issue is found in the Web Management Interface component of the router, specifically the file /cgi-bin/cstecgi.cgi. Users of this model and firmware version are affected.

The CVSS score of 9.3 indicates critical severity. EPSS is not available, but the vulnerability is publicly known and can be exploited remotely via the web interface. The vulnerability is not listed in the CISA KEV catalog, but the availability of an exploit in public sources and the remote nature of the attack mean that a malicious actor could compromise the device with little effort. Information about authentication requirements is not provided in the available data.