A critical vulnerability has been identified in Totolink A8000RU router firmware version 7.1cu.643_b20200521. The vulnerability exists in the setDmzCfg function within the CGI handler component at /cgi-bin/cstecgi.cgi. An attacker can manipulate the wanIdx argument to achieve OS command injection. The vulnerability can be exploited remotely, making it particularly dangerous. Public exploits are already available, increasing the risk of active exploitation. This affects the router's web interface and could allow attackers to execute arbitrary commands on the device.