The vulnerability allows a remote attacker to inject arbitrary operating system commands through the bgProtection argument in the cstecgi.cgi script of the router’s web interface. Successful exploitation allows the router to execute attacker‑supplied commands with system privileges. This flaw is classified as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).

Firmware version 7.1cu.643_b20200521 of the Totolink A8000RU router is affected. No other device models or firmware releases were listed as vulnerable.

The CVSS base score of 9.3 indicates critical severity. The vulnerability can be triggered remotely through the exposed web interface. The EPSS score of 3% indicates a low but non‑zero probability of exploitation, and the public release of an exploit suggests that the risk of exploitation is significant. The vulnerability is not listed in CISA’s KEV catalog, but the existing public exploit and high CVSS score indicate that many attackers could leverage this flaw if the router is exposed to the internet.