The vulnerability allows a remote attacker to inject arbitrary operating system commands through the bgProtection argument in the cstecgi.cgi script of the router’s web interface. Successful exploitation results in the router executing attacker‑supplied commands with system privileges, giving the attacker complete control over the device. This flaw is classified as CWE‑77 (Command Injection) and CWE‑78 (OS Command Injection). The impact includes full system compromise, data theft, network disruption, and potential use as a foothold for further attacks.

Firmware version 7.1cu.643_b20200521 of the Totolink A8000RU router is affected. No other device models or firmware releases were listed as vulnerable.

The CVSS base score of 9.3 indicates critical severity and high attack complexity, and the vulnerability can be triggered remotely via the exposed web interface. EPSS data is not available, but the public release of an exploit suggests that the risk of exploitation is significant. The vulnerability is not listed in CISA’s KEV catalog, but the existing public exploit and high CVSS score indicate that many attackers could leverage this flaw if the router is exposed to the internet.