A critical OS command injection vulnerability has been discovered in Totolink A8000RU router firmware version 7.1cu.643_b20200521. The flaw affects the setWizardCfg function in the CGI Handler component, specifically in the /cgi-bin/cstecgi.cgi file. Attackers can exploit this vulnerability by manipulating the wizard argument to execute arbitrary OS commands. The vulnerability can be exploited remotely, making it particularly dangerous. An exploit has already been published and is available for use, increasing the immediate risk to affected devices.