The flaw allows an attacker to inject arbitrary operating‑system commands by manipulating the resetFlags parameter in the setUpgradeFW function of the cstecgi.cgi script. Based on the description, it is inferred that the attacker can direct malicious HTTP requests to the vulnerable endpoint remotely. This remote OS command injection can be leveraged to execute any command with the privileges of the web management interface process, providing full control over the device and compromising confidentiality, integrity, and availability.

Affected system is Totolink A8000RU routers running firmware version 7.1cu.643_b20200521. Only this version was verified to be impacted; earlier firmware revisions may not be affected.

The CVSS score of 9.3 marks this as critical. The EPSS score of 3% indicates a moderate but non‑negligible probability that the vulnerability will be exploited, and the public release of the exploit combined with the ability to launch attacks remotely heightens the risk. The vulnerability is not listed in CISA KEV, yet the exposed web interface provides a feasible attack surface for remote adversaries. Based on the description, it is inferred that an attacker could remotely send crafted HTTP requests to the Web Management Interface from any machine that can reach the router.