The C8000RU router’s web management interface allows configuration of OpenVPN settings through the setOpenVpnCfg endpoint in cstecgi.cgi. By manipulating request parameters, an attacker can inject arbitrary operating system commands, enabling remote command execution. This vulnerability can lead to full compromise of the device, including data exfiltration, denial of service, or deployment of malware. The weakness is a classic command injection flaw (CWE-77 and CWE-78).

Affected devices are Totolink A8000RU routers running firmware version 7.1cu.643_b20200521. The issue resides in the Web Management Interface component, specifically the setOpenVpnCfg function in the cstecgi.cgi CGI script.

The vulnerability carries a CVSS score of 9.3, indicating critical severity. Although there is no EPSS score reported, the publicly disclosed exploit and its remote nature suggest a high likelihood of real-world exploitation. The attack vector is remote over the network, likely via HTTP/HTTPS requests to the router’s management interface. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS score warrants immediate attention.