The flaw resides in the UploadOpenVpnCert function of the cstecgi.cgi handler, where the FileName parameter is unsafely passed to the operating system shell. An attacker can craft a value that injects arbitrary commands, allowing execution of native OS commands. The vulnerability is a classic OS command injection tied to CWE‑77 and CWE‑78. Remote exploitation is possible directly through the router’s web management interface, though the CVE description does not explicitly state authentication requirements; it is inferred that the attacker may need access to the web interface from an external or exposed network.

Totolink routers model A8000RU running firmware 7.1cu.643_b20200521 are affected. The problematic code is part of the Web Management Interface component accessed via /cgi-bin/cstecgi.cgi.

The CVSS score of 9.3 marks this vulnerability as Critical, and the EPSS score of 3% indicates a moderate likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, but the public disclosure of an exploit and the description of remote exploitation suggest it is high priority. Based on the CVE description stating remote exploitation is possible, it is inferred that the attacker could reach the router via the web interface from an external or exposed network; authentication barriers are not specified in the provided information.