The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 contains an OS command injection vulnerability in the setScheduleCfg function of /cgi-bin/cstecgi.cgi. By manipulating the 'mode' argument, an attacker can inject and execute arbitrary operating system commands remotely without authentication. This vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The vulnerability is publicly disclosed with an available exploit, but no vendor patch or official remediation has been released. The affected product is not a cloud service, so remediation depends on vendor firmware updates.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary OS commands on the affected device, potentially leading to full control over the router. This can compromise the device's integrity and availability. However, there are currently no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published, users should monitor Totolink's official channels for firmware updates addressing this vulnerability. Until a patch is available, restricting remote access to the device's management interface and disabling unnecessary services may reduce exposure.