A critical OS command injection vulnerability (CVE-2026-7203) was discovered in Totolink A8000RU router firmware version 7.1cu.643_b20200521. The vulnerability affects the setUrlFilterRules function in the CGI Handler component at /cgi-bin/cstecgi.cgi. Attackers can manipulate the 'enable' argument to execute arbitrary OS commands remotely. The exploit code has been publicly disclosed and is available on GitHub, making this vulnerability particularly dangerous for affected devices. This represents a significant security risk for network infrastructure as it allows remote code execution on networking equipment.