A critical security vulnerability (CVE-2026-7155) has been identified in Totolink A8000RU router firmware version 7.1cu.643_b20200521. The vulnerability affects the setLoginPasswordCfg function in the CGI Handler component, specifically in the /cgi-bin/cstecgi.cgi file. Attackers can exploit this flaw by manipulating the 'admpass' argument to achieve OS command injection. The vulnerability can be exploited remotely, making it particularly dangerous. The exploit details have been publicly disclosed and are available for use, increasing the risk of active exploitation. This affects the router's authentication mechanism and could allow attackers to execute arbitrary commands on the device.