A security vulnerability has been discovered in Totolink A8000RU router version 7.1cu.643_b20200521. The flaw affects the setVpnPassCfg function in /cgi-bin/cstecgi.cgi of the CGI Handler component. Attackers can manipulate the pptpPassThru argument to achieve OS command injection. The vulnerability can be exploited remotely, making it particularly dangerous. A public exploit has been released and is available for potential attackers to use. This represents a critical security risk for affected devices as it allows remote code execution capabilities.