The Totolink A7100RU router firmware 7.4cu.2313_b20191024 contains an OS command injection vulnerability identified as CVE-2026-5688. The vulnerability is located in the setDdnsCfg function of the /cgi-bin/cstecgi.cgi script. By manipulating the 'provider' parameter, an attacker can inject operating system commands remotely without authentication. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, low complexity, and no privileges or user interaction required. The vulnerability has been publicly disclosed, but no vendor patch or official remediation has been provided yet.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary OS commands on the affected Totolink A7100RU device without authentication. This could lead to compromise of the device, unauthorized control, and potential further network intrusion. However, there are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the device's management interface from untrusted networks and monitor for unusual activity. Avoid exposing the device's web management interface to the internet. Follow vendor communications for updates on patches or mitigations.