A weakness exists in the setRemoteCfg function of the /cgi-bin/cstecgi.cgi component within the Web Management Interface of Totolink A8000RU firmware. Manipulation of the enable argument allows an attacker to inject operating‑system commands, resulting in arbitrary code execution with the privileges of the web service. Such an exploit can compromise confidentiality, integrity, and availability of the device and any network resources it controls.

The vulnerability affects Totolink A8000RU devices running firmware version 7.1cu.643_b20200521. No other versions are reported as affected.

The CVSS score of 9.3 indicates a high severity exploit that can be performed remotely, likely through the publicly exposed web interface. The EPSS score is not available, so the current likelihood of exploitation is unknown, but the presence of a publicly available exploit suggests a potential for real‑world attacks. The vulnerability is not listed in CISA’s KEV catalog, indicating it has not yet been documented as a known exploited vulnerability by that authority.