The flaw exists in the setLanguageCfg function of the /cgi-bin/cstecgi.cgi Web Management Interface on Totolink A8000RU routers. By altering the lang argument, an attacker can inject operating‑system commands, causing the router to execute arbitrary code. The weakness is a classic command‑injection vulnerability classified as CWE‑77 and CWE‑78, and it results in full control over the device if exploited.

Vulnerable only the Totolink A8000RU running firmware 7.1cu.643_b20200521. No other models or firmware releases are mentioned as affected, so devices with different firmware versions or brands are not at risk according to the current data.

The condition for exploitation is remote access to the router’s Web Management Interface, which is typically reachable over HTTP(S). The CVSS score of 9.3 signals a high‑severity risk, and public proof‑of‑concept exploits are available, meaning attackers can target unpatched routers without local access. Although the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, the combination of remote operability and severe impact makes the risk high and warrants immediate remediation.