The flaw resides in the setOpenVpnCertGenerationCfg function of the Totolink A8000RU’s cstecgi.cgi, where manipulating the servername parameter can lead to arbitrary operating system command injection. This exploitation would allow an attacker to execute any shell command with the privileges of the device, potentially compromising the router’s firmware and the network it manages. The vulnerability falls under CWE-77 and CWE-78 and results in loss of confidentiality, integrity, and availability of the device and connected resources.

Affected devices are Totolink A8000RU routers running firmware version 7.1cu.643_b20200521. No other versions have been confirmed to be impacted, but users should verify whether newer revisions contain the same flaw. The vulnerability is limited to the web management interface and specifically the cstecgi.cgi script handling OpenVPN certificate generation configuration.

The CVSS score of 9.3 reflects a critical impact, and the EPSS score of 3% indicates a low probability of exploitation, although public exploits have been released, indicating that attackers already have functioning attack code. Based on the description, it is inferred that the vulnerability can be triggered via the router’s web interface, but the authentication requirements are unclear. The absence of a CISA KEV listing does not reduce the threat because the flaw is widely known and actively used.