A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the…

A critical vulnerability has been identified in Totolink A8000RU router firmware version 7.1cu.643_b20200521. The vulnerability exists in the setDmzCfg function within the CGI handler component at /cgi-bin/cstecgi.cgi. An attacker can manipulate the wanIdx argument to achieve OS command injection. The vulnerability can be exploited remotely, making it particularly dangerous. Public exploits are already available, increasing the risk of active exploitation. This affects the router's web interface and could allow attackers to execute arbitrary commands on the device.