A buffer around the parameter firing that controls firewall settings in the Totolink A8000RU Web Management Interface has been exploited to execute arbitrary operating‑system commands on the device. The vulnerability is a classic OS command injection flaw, mapped to CWE‑77 and CWE‑78. Successful exploitation would allow an attacker to run arbitrary code on the router, compromise device integrity, and potentially pivot to other network assets.

The affected hardware is the Totolink A8000RU router, firmware 7.1cu.643_b20200521. Broad users of this model who have the web management interface enabled should verify their installed firmware and plan an update.

The CVSS score of 9.3 reflects a high‑severity impact. The EPSS score is not available, but the vulnerability is listed in publicly shared exploits and is therefore a credible threat. The attacker can reach the vulnerable parameter remotely via the web interface, likely from any compromised or malicious machine on the internet. No KEV listing is available, yet the remote nature and high CVSS warrant immediate attention.