This vulnerability affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The issue lies in the CsteSystem function within /cgi-bin/cstecgi.cgi, where improper handling of the resetFlags argument leads to OS command injection. This allows an unauthenticated remote attacker to execute arbitrary OS commands on the device. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. Exploit code has been publicly released, increasing the risk of exploitation. No official patch or vendor advisory is currently available.

Successful exploitation could allow remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to unauthorized control or disruption of the router. The vulnerability requires no authentication and can be triggered remotely, increasing the attack surface. However, the CVSS score and lack of confirmed exploits in the wild suggest moderate impact severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting remote access to the affected device and monitor for unusual activity. No official vendor mitigation or temporary fix has been published at this time.