A parser bug in the setTracerouteCfg function of the /cgi-bin/cstecgi.cgi web component allows an attacker to inject arbitrary operating‑system commands. The flaw is exercised through the command argument supplied in the request, leading directly to command execution on the router’s firmware. The result is complete remote compromise: an attacker can install malware, exfiltrate configuration data, or disrupt device operation. The weakness is classified as CWE-77 and CWE-78, indicating an unsafe use of user input in a system command invocation.

The vulnerability applies to the Totolink A8000RU router, specifically firmware version 7.1cu.643_b20200521. No other vendor or product versions are reported to be affected.

With a CVSS score of 9.3, the flaw ranks as critical, and the exploit has been publicly disclosed, meaning it is likely to be actively used. While an EPSS score is not available, the absence of a low number should not reduce the urgency. The device can be reached remotely through its web management interface, so the attack vector is remote and does not require local access. The vulnerability is not listed in the CISA KEV catalog, but its severity, public availability, and broad impact make it a high‑risk issue that requires urgent response.