A flaw in the setQosCfg function of the /cgi-bin/cstecgi.cgi script permits attackers to inject arbitrary operating system commands by manipulating the enable argument. The vulnerability is identified as an OS command injection with a CVSS score of 9.3, indicating that an attacker can execute malicious code with the privileges of the web management interface. Remote exploitation is possible and the public exploit is available.

Totolink A8000RU routers running firmware 7.1cu.643_b20200521 are affected. The vulnerability resides in the Web Management Interface component of this device.

The high CVSS score and lack of any listed KEV entry do not diminish the risk; the public availability of an exploit lowers the practical barrier to attack. An attacker who can reach the web interface—whether from the internal network or via an exposed management interface—can trigger the command injection. The exploit does not appear to require privileged access beyond the web interface, making it feasible in many deployment scenarios.