A vulnerability in the Totolink A8000RU firmware allows an attacker to manipulate the wscDisabled parameter of the setWiFiWpsCfg function, which directly leads to OS command injection from the web management interface. The flaw exists within /cgi-bin/cstecgi.cgi and can cause arbitrary code execution with the privileges of the web daemon. If an attacker abuses this, they could gain unrestricted control over the device, modify network settings, or use the device as a foothold for subsequent attacks on connected endpoints.

The affected product is the Totolink A8000RU running firmware version 7.1cu.643_b20200521, as enumerated in the CNA product list and CPE data. No other firmware releases or models are listed as vulnerable, so the scope is limited to this specific build.

The CVSS score of 9.3 classifies the issue as Critical, and the EPSS score of 2% indicates a low but non‑negligible probability of exploitation. The vulnerability is not present in the CISA KEV catalog, but it has been publicly disclosed and can be accessed remotely through crafted HTTP requests to /cgi-bin/cstecgi.cgi. Attackers can send a malicious wscDisabled argument from an external network and trigger the OS command injection without any authentication requirement inferred from the description.