An OS command injection flaw exists in the setPasswordCfg handler of /cgi-bin/cstecgi.cgi on Totolink A8000RU routers. By injecting crafted input into the admpass argument, an attacker can cause arbitrary shell commands to be executed on the device. The vulnerability is located within the Web Management Interface and would allow an attacker to compromise the router’s operating system, potentially granting full control over the device and any networks it bridges.

The flaw is confirmed in Totolink A8000RU firmware version 7.1cu.643_b20200521. It affects the web management component of this router model and does not list any other affected firmware releases in the input data. Users of this device model should verify their firmware against the specified version.

The CVSS score of 9.3 categorizes this as critical. The exploit is publicly available and can be performed remotely without additional authentication steps inferred from the description. Although EPSS data is not provided, the lack of KEV listing does not diminish the high risk posed by the ability to inject and execute arbitrary commands on the router’s operating system. The vulnerability allows attackers to possibly elevate privileges, modify routing tables, and exfiltrate data.