The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 contains an OS command injection vulnerability in the setScheduleCfg function of /cgi-bin/cstecgi.cgi. By manipulating the 'mode' parameter, an attacker can remotely execute arbitrary operating system commands without authentication. This vulnerability has been publicly disclosed and carries a CVSS 4.0 base score of 6.9 (medium severity). There is no vendor advisory or patch available at this time, and the device is not cloud-hosted, so remediation requires a firmware update from Totolink.

Successful exploitation allows a remote unauthenticated attacker to execute arbitrary OS commands on the affected device. This could lead to compromise of the router, potentially affecting network security and device integrity. The vulnerability is rated medium severity with a CVSS score of 6.9. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor Totolink communications for firmware updates addressing this issue. Until a patch is released, restricting access to the device's management interface from untrusted networks may reduce exposure.